Verify your sending domain
Add DKIM, SPF, and a verification CNAME at your DNS provider so SESMetric can sign and authenticate mail from your domain.
By SESMetric Docs
Every outbound message must come from a verified identity — either a single email address or a whole domain. Domain verification is the right path for production: any address under the domain can send, and DKIM + SPF give the best deliverability.
1. Add the domain
In the dashboard go to Senders → Add identity → Domain and enter the apex (e.g. example.com). The dashboard shows three CNAME records to add.
2. CNAME records to publish
| Host | Points to | Purpose |
|---|---|---|
selector1._domainkey.example.com | selector1.sesmetric-dkim.com | DKIM signing key 1 |
selector2._domainkey.example.com | selector2.sesmetric-dkim.com | DKIM signing key 2 (rotation) |
_amazonses.example.com | (provided in dashboard) | Verification token |
Add all three at your DNS provider. Most clouds (Cloudflare, Route 53, Vercel DNS, Namecheap) accept CNAMEs at any subdomain.
3. SPF — add a TXT record
If you don't already have an SPF record, publish one:
v=spf1 include:amazonses.com ~all
If you already have an SPF record, don't add a second one — extend the existing record with include:amazonses.com before the ~all / -all token.
4. DMARC (recommended)
Once DKIM and SPF are passing, publish a DMARC policy at _dmarc.example.com:
v=DMARC1; p=none; rua=mailto:dmarc@example.com
Start with p=none to monitor, then move to quarantine once your reports look clean for two weeks.
5. Wait for verification
The dashboard polls for the verification CNAME every few minutes. Once detected, the identity flips to verified and the dkim_set / spf_set flags turn green. Most propagations complete within 5–30 minutes.
6. Troubleshooting
- Stuck on pending after an hour — confirm with
dig CNAME _amazonses.example.comfrom a public resolver (@1.1.1.1). If empty, the DNS change hasn't propagated. - Apex CNAME not supported — use a subdomain (
mail.example.com) or your DNS provider'sALIAS/ANAMEflattening feature. dkim=failin inbox headers — check that both selector CNAMEs resolve. SESMetric rotates between them.- SPF
permerror— you have more than 10 DNS lookups in your SPF record. Flatten with a tool like dmarcian.
7. Rotating DKIM keys
SESMetric uses two DKIM selectors so we can rotate without downtime. To force rotation, click Rotate DKIM in the identity detail view; we'll generate new public keys and update the CNAME targets. You then re-publish the CNAMEs; we keep the old selector signing until the new one is verified.