Skip to main content

AWS Glossary

DKIM

DomainKeys Identified Mail — cryptographic email signatures that prove a domain authorized the message; SES supports Easy DKIM and BYODKIM.

Last reviewed: July 2026
Amazon SES Easy DKIMAmazon SES BYODKIM

Definition

DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to outbound messages. Receivers look up the public key in DNS (selector._domainkey.example.com) and verify that headers/body were authorized by the signing domain. For DMARC, the DKIM signing domain must align with the visible From domain (organizational domain match under relaxed alignment).

When to use it

  • All Amazon SES production sending (Easy DKIM is the default path)
  • Multi-ESP setups where you bring your own key (BYODKIM) for consistent selectors across vendors
  • Bulk-sender compliance (Google, Yahoo, Microsoft) requiring authenticated, aligned mail

When not to use it

  • Signing with a third-party ESP domain that does not align to your From domain if you need DMARC pass
  • Rotating keys without dual-publishing DNS long enough for in-flight mail

Tips

  • Prefer 2048-bit keys where supported (SES Easy DKIM supports them)
  • Keep selector DNS CNAMEs (Easy DKIM) or TXT public keys (BYODKIM) under change control
  • Verify alignment on live messages via Authentication-Results headers, not console checkmarks alone

Gotchas

Serious

  • Body/header modifications by intermediate relays that break signatures
  • From domain marketing.brand.com signed as esp-mail.com without alignment → DMARC fail

Regular

  • Leaving old selectors published forever after rotation (harmless but noisy)

Related FactualMinds content

Related Services

Amazon SES Email Deliverability Consulting | FactualMinds

Amazon SES email consulting from an AWS Select Tier Partner. SPF/DKIM/DMARC setup, inbox placement optimization, sender reputation, and scalable email infrastructure.

View service

SES Migration & Email Delivery Services | FactualMinds

SES migration consulting — move from SendGrid, Mailgun, Postmark, or SparkPost to Amazon SES. Deliverability, SPF/DKIM/DMARC, monitoring, compliance.

View service

Related Articles

BIMI with Amazon SES: Complete Implementation Guide (VMC, SVG, DMARC)

BIMI on Amazon SES: lab readiness score 38→92 after DMARC quarantine at pct=100, SVG MIME fix, and CloudFront OAC — plus Terraform/CDK and free validators.

Read article

How to Migrate from SendGrid to Amazon SES (Step-by-Step)

Migrating from SendGrid to SES is mostly cheap — until your warm-up plan is wrong and deliverability falls off a cliff. DNS cutover, IP warming, API surface differences, and the deliverability checkpoints that keep email landing in inboxes through the switch.

Read article

Amazon SES Cold Email for B2B: Compliance and Deliverability Setup (2026)

Legitimate B2B outbound on SES in 2026: sandbox exit, SPF/DKIM/DMARC, RFC 8058, Microsoft May 2025 bars, warm-up, and when Pro DIPs beat shared pools — with a first-party compliance checklist.

Read article

Need help with this topic?

Our AWS-certified team implements, audits, and optimizes these services in production — from Bedrock RAG pipelines to multi-account landing zones.

Talk to AWS Experts