Amazon SES + Google SPF with MailAuth Doctor
The builder opens with Amazon SES and Google Workspace ticked. It builds the merged record and shows the lookup arithmetic.
- Keep Amazon SES and Google Workspace ticked.
- Add other senders and choose the ending.
- Copy the merged record and publish one SPF TXT record.
- Check the live domain and, if you use SES, also set up DKIM for it.
What to know
The merged record is v=spf1 include:amazonses.com include:_spf.google.com ~all. Amazon documents include:amazonses.com for domains that send through SES and use the default MAIL FROM; a custom MAIL FROM domain needs its own SPF record on that subdomain.
On 2026-10-10 both includes measured at one lookup each, so the pair uses two of ten. SES's DKIM selectors are random per-customer tokens, so the DKIM probe cannot find them by name: copy the selector from the DKIM-Signature header of a test message.
For DMARC, SES passes alignment through DKIM when you verify your domain with Easy DKIM, because the signature is then made with your own domain. That matters more than SPF here: SES's default bounce domain belongs to Amazon, so SPF passes but does not align with your From domain.
Updated · Cosmovex
Questions
What is the SPF record for Amazon SES and Google Workspace?
v=spf1 include:amazonses.com include:_spf.google.com ~all as one TXT record.
Why can I not find my SES DKIM selector?
SES uses random per-customer selector names. Read the s= value from the DKIM-Signature header of a message you sent through SES.
Does SES SPF pass DMARC?
By default the bounce domain is Amazon's, so SPF passes but does not align with your From domain. DKIM signed with your own domain gives DMARC alignment.
How many lookups does it use?
Two as measured on 2026-10-10: one for each include.
The free plan covers everything on this page. MailAuth Doctor Pro ($7/mo, billed monthly) is described on the MailAuth Doctor page.
