The New Reality of DMARC Compliance
In February 2024, Google and Yahoo enacted strict deliverability mandates for all domain senders. Any organization transmitting more than 5,000 emails daily without strict SPF, DKIM, and a valid DMARC policy faces immediate throttling, spam folder placement, or outright 550 rejection.
To achieve 100% inbox deliverability, modern senders must advance their policy from passive monitoring (p=none) to active protection (p=reject). Here is how to configure AWS SES and Cloudflare DNS to achieve zero-defect email authentication.
Step 1: Set Up 3x Easy DKIM CNAME Records
In AWS SES, navigate to Identities → Your Domain → Authentication. AWS SES utilizes Easy DKIM with 2048-bit keys, generating three distinct CNAME records pointing to *.dkim.amazonses.com.
Record Type: CNAME
Name: [selector1]._domainkey.yourdomain.com
Target: [selector1].dkim.amazonses.com
Proxy: DNS Only (Gray Cloud in Cloudflare!)Critical Warning: In Cloudflare, ensure the proxy status is toggled to DNS Only (Gray Cloud). Proxied CNAME records will prevent external mail servers from resolving your public DKIM key.
Step 2: Configure Custom MAIL FROM for Strict SPF Alignment
By default, AWS SES uses its own domain (amazonses.com) in the SMTP envelope Return-Path. Under DMARC alignment rules, this creates an SPF mismatch with your From: [email protected] header!
To achieve strict SPF alignment:
- In AWS SES, enable Custom MAIL FROM domain (e.g.,
mail.yourdomain.com). - Add an MX record in Cloudflare:
Type: MX | Name: mail | Server: feedback-smtp.us-east-1.amazonses.com | Priority: 10 - Add a TXT record for SPF:
Type: TXT | Name: mail | Value: "v=spf1 include:amazonses.com ~all"
Step 3: Publish Your DMARC Record with p=reject
Once SPF and DKIM have been active for at least 48 hours without delivery errors, publish your DMARC enforcement policy at _dmarc.yourdomain.com:
Type: TXT
Name: _dmarc
Value: "v=DMARC1; p=reject; pct=100; rua=mailto:[email protected]; aspf=r; adkim=r;"DMARC Tag Breakdown:
p=reject: Instructs Gmail, Outlook, and Yahoo to block any email purporting to be from your domain that fails authentication.pct=100: Applies the reject policy to 100% of outbound messages.rua=...: Directs aggregate XML diagnostic reports to your monitoring mailbox.aspf=r & adkim=r: Requires relaxed alignment between the header From and envelope domains.
Automated Verification in Solidrix Send
Solidrix Send includes automated DNS identity verification. Enter your domain in the Domains console to verify SPF, DKIM, and DMARC status with a single click before initiating any high-volume broadcast.
