Amazon SES’s SPF include goes on a subdomain, not your root record.
Only on a custom MAIL FROM subdomain, alongside an MX to feedback-smtp.<region>.amazonses.com. By default SES uses a subdomain of amazonses.com as the MAIL FROM, so SPF passes without any record of yours (but doesn’t align with your domain; DKIM carries DMARC). Measured on 4 Nov 2026, the include costs 1 of your 10 SPF lookups, leaving 9 for everything else.
- Include
- amazonses.com
- Vendor’s record
- subdomain.domain.com TXT "v=spf1 include:amazonses.com ~all"
- Where it goes
- A subdomain the service gives you
- Needed on your root?
- Only with a custom return-path/MAIL FROM
- Lookups (measured)
- 1 of 10
- Ranges published
- 13 ip4 · 0 ip6
- Category
- Cloud email
What include:amazonses.com expands to live, 4 Nov 2026
v=spf1 ip4:199.255.192.0/22 ip4:199.127.232.0/22 ip4:54.240.0.0/18 ip4:69.169.224.0/20 ip4:23.249.208.0/20 ip4:23.251.224.0/19 ip4:76.223.176.0/20 ip4:54.240.64.0/18 ip4:76.223.128.0/19 ip4:216.221.160.0/19 ip4:206.55.144.0/20 ip4:24.110.64.0/18 ip4:98.77.0.0/16 -all
Counted as RFC 7208 §4.6.4 does: the include itself plus every nested include, a, mx, ptr, exists and redirect. Includes can change at any time; this page re-measures daily.
How it affects DMARC
DMARC passes when SPF or DKIM passes for a domain aligned with your From address. Because Amazon SES authenticates SPF on its own or a delegated return-path domain, alignment for your From domain usually comes from DKIM, so set up its DKIM records for your domain.
Other cloud email services
Sources
- Amazon SES: Using a custom MAIL FROM domain · checked 5 Oct 2026
- Amazon SES: Authenticating with SPF · checked 5 Oct 2026
- RFC 7208 §4.6.4: DNS lookup limits · checked 5 Oct 2026
peekip isn’t affiliated with Amazon SES; follow the vendor’s own setup page, which shows the exact values for your account.