Creating and verifying identities in Amazon SES

To create a domain identity

1. Sign in to the AWS Management Console and open the Amazon SES console at https://console.aws.amazon.com/ses/.

2. In the navigation pane, under Configuration, choose Verified identities.

3. Choose Create identity.

4. Under Identity details, select Domain as the type of identity you want to create. You must have access to the domain’s DNS settings to complete the domain verification process.

5. Enter the name of the domain or subdomain in the Domain field.

   Tip

   If your domain is www.example.com, enter example.com as your domain. Don't include the "www." part, because the domain verification process won't succeed if you do.

6. (Optional) If you want to Assign a default configuration set, select the check box.

   1. For Default configuration set, select the existing configuration set that you want to assign to your identity. If you haven’t created any configuration sets yet, see Using configuration sets in Amazon SES.

      Note

      Amazon SES only defaults to the assigned configuration set when no other set is specified at the time of sending. If a configuration set is specified, Amazon SES applies the specified set in place of the default set.

7. (Optional) If you want to Use a custom MAIL FROM domain, select the check box and complete the following steps. For more information, see Using a custom MAIL FROM domain.

   1. For MAIL FROM domain, enter the subdomain that you want to use as the MAIL FROM domain. This must be a subdomain of the domain identity that you’re verifying. The MAIL FROM domain shouldn't be a domain from which you send email.

   2. For Behavior on MX failure, indicate which action Amazon SES should take if it can’t find the required MX record at the time of sending. Choose one of the following options:

      • Use default MAIL FROM domain - If the custom MAIL FROM domain's MX record is not set up correctly, Amazon SES will use a subdomain of amazonses.com. The subdomain varies based on the AWS Region in which you use Amazon SES.

      • Reject message - If the custom MAIL FROM domain's MX record is not set up correctly, Amazon SES will return a MailFromDomainNotVerified error. If you choose this option, emails that you attempt to send from this domain are automatically rejected.

   3. For Publish DNS records to Route53, if your domain is hosted through Amazon Route 53, you have the option to let SES publish the associated TXT and MX records at the time of creation by leaving Enabled checked. If you'd rather publish these records later, clear the Enabled checkbox. (You can come back at a later time to publish the records to Route 53 by editing the identity - see Edit an identity using the SES console.)

8. (Optional) To configure customized DKIM-based verification, other than the SES default setting which uses Easy DKIM with a 2048 bit singing length, under Verifying your domain, expand Advanced DKIM settings and choose the type of DKIM you want to configure:

   1. Easy DKIM:

      1. Under Identity type, choose Easy DKIM.

      2. In the DKIM signing key length field, choose either RSA_2048_BIT or RSA_1024_BIT.

      3. For Publish DNS records to Route53, if your domain is hosted through Amazon Route 53, you have the option to let SES publish the associated CNAME records at the time of creation by leaving Enabled checked. If you'd rather publish these records later, clear the Enabled checkbox. (You can come back at a later time to publish the records to Route 53 by editing the identity - see Edit an identity using the SES console.)

   2. Deterministic Easy DKIM (DEED):

      Tip

      This form of DKIM is to be used if you're creating a Global (replica) identity. DEED will utilize the Easy DKIM setup of an existing identity of the same name from a parent region and sign the new identity without requiring you to perform additional DNS setup. For more information, see DEED.

      1. Under Identity type, choose Deterministic Easy DKIM.

      2. From the Parent region dropdown menu, select a parent region where an Easy DKIM-signed identity with the same name as you entered for your Global (replica) identity resides. (Your replica region defaults to the region you signed into the SES console with.)

   3. Provide DKIM authentication token (BYODKIM):

      1. Ensure you've already generated a public-private key pair and have added the public key to your DNS host provider. For more information, see Provide your own DKIM authentication token (BYODKIM) in Amazon SES.

      2. Under Identity type, choose Provide DKIM authentication token (BYODKIM).

      3. For Private key, paste the private key you generated from your public-private key pair. The private key must use at least 1024-bit RSA encryption and up to 2048-bit, and must be encoded using base64 (PEM) encoding.

         Note

         You have to delete the first and last lines (-----BEGIN PRIVATE KEY----- and -----END PRIVATE KEY-----, respectively) of the generated private key. Additionally, you have to remove the line breaks in the generated private key. The resulting value is a string of characters with no spaces or line breaks.

      4. For Selector name, enter the name of the selector to be specified in your domain’s DNS settings.

9. Ensure that the Enabled box is checked in the DKIM signatures field.

10. (Optional) Add one or more Tags to your domain identity by including a tag key and an optional value for the key:

    1. Choose Add new tag and enter the Key. You can optionally add a Value for the tag.

    2. Repeat for additional tags not to exceed 50, or choose Remove to remove tags.

11. Choose Create identity.

To verify a DKIM domain identity with your DNS provider

1. From the Loaded identities table, select the domain you want to verify.

2. On the Authentication tab of the identity details page, expand Publish DNS records.

3. Depending on which flavor of DKIM you configured your domain with, Easy DKIM or BYODKIM, follow the respective instructions:

   Easy DKIM

   To verify a domain configured with Easy DKIM

   1. From the Publish DNS records table, copy the three CNAME records that appear in this section to be published (added) to your DNS provider. Alternatively, you can choose Download .csv record set to save a copy of the records to your computer.

      The following image shows an example of the CNAME records to publish to your DNS provider.

      

   2. Add the CNAME records to your domain’s DNS settings respective of your DNS host provider:

      • All DNS host providers (excluding Route 53) – Login to your domain’s DNS or web hosting provider, and then add the CNAME records containing the values that you copied or saved previously. Different providers have different procedures for updating DNS records. See the DNS/Hosting provider table following these procedures.

        Note

        A small number of DNS providers don't allow you to include underscores (_) in record names. However, the underscore in the DKIM record name is required. If your DNS provider doesn't allow you to enter an underscore in the record name, contact the provider's customer support team for assistance.

      • Route 53 as your DNS host provider – If you use Route 53 on the same account that you use when you send email using SES, and the domain is registered, SES automatically updates the DNS settings for your domain if you enabled SES to publish them at the time of creation. Otherwise, you can easily publish them to Route 53 with a button click after creation - see Edit an identity using the SES console. If your DNS settings don’t update automatically, or you want to add CNAME records to Route 53 that aren't on the same account you use when you send email using SES, complete the procedures in Editing records.

      • If you're not sure who your DNS provider is – Ask your system administrator for more information.

   BYODKIM

   To verify a domain configured with BYODKIM

   1. To recap, when you created your domain with BYODKIM, or you configured an existing domain with BYODKIM, you added the private key (from your self-generated public-private key pair) and selector name prefix into their respective fields on the SES console's Advance DKIM Settings page. Now you must complete the verification process by updating the following records for your DNS host provider.

   2. From the Publish DNS records table, copy the selector name record that appears in the Name column to be published (added) to your DNS provider. Alternatively, you can choose Download .csv record set to save a copy of it to your computer.

      The following image shows an example of the selector name record to publish to your DNS provider.

      

   3. Login to your domain’s DNS or web hosting provider, and then add the selector name record you copied or saved previously. Different providers have different procedures for updating DNS records. See the DNS/Hosting provider table following these procedures.

      Note

      A small number of DNS providers don't allow you to include underscores (_) in record names. However, the underscore in the DKIM record name is required. If your DNS provider doesn't allow you to enter an underscore in the record name, contact the provider's customer support team for assistance.

   4. If you haven't done so already, be sure to add the public key from your from your self-generated public-private key pair to your domain's DNS or web hosting provider.

      Note that in the Publish DNS records table, the public key record that appears in the Value column only displays, “p=customerProvidedPublicKey”, as a placeholder for the public key value you saved to your computer or supplied to your DNS provider.

      Note

      When you publish (add) your public key to your DNS provider, it must be formatted as follows:

      • You have to delete the first and last lines (-----BEGIN PUBLIC KEY----- and -----END PUBLIC KEY-----, respectively) of the generated public key. Additionally, you have to remove the line breaks in the generated public key. The resulting value is a string of characters with no spaces or line breaks.

      • You must include the p= prefix as shown in the Value column in the Publish DNS records table.

4. It can take up to 72 hours for changes to DNS settings to propagate. As soon as Amazon SES detects all of the required DKIM records in your domain’s DNS settings, the verification process is complete. Your domain’s DKIM configuration appears as Successful and the Identity status appears as Verified.

5. If want to configure and verify a custom MAIL FROM domain, follow the procedures in Configuring your custom MAIL FROM domain.

To create an email address identity (console)

1. Sign in to the AWS Management Console and open the Amazon SES console at https://console.aws.amazon.com/ses/.

2. In the navigation pane, under Configuration, choose Verified identities.

3. Choose Create identity.

4. Under Identity details, choose Email address as the identity type you want to create.

5. For Email address, enter the email address that you want to use. The email address must be an address that’s able to receive mail and that you have access to.

6. (Optional) If you want to Assign a default configuration set, select the check box.

   1. For Default configuration set, select the existing configuration set that you want to assign to your identity. If you haven’t created any configuration sets yet, see Using configuration sets in Amazon SES.

      Note

      Amazon SES only defaults to the assigned configuration set when no other set is specified at the time of sending. If a configuration set is specified, Amazon SES applies the specified set in place of the default set.

7. (Optional) Add one or more Tags to your domain identity by including a tag key and an optional value for the key:

   1. Choose Add new tag and enter the Key. You can optionally add a Value for the tag.

   2. Repeat for additional tags not to exceed 50, or choose Remove to remove tags.

8. To create your email address identity, choose Create identity. After it's created, you should receive a verification email within five minutes. The next step is to verify your email address by following the verification procedure in the next section.

   Note

   You can customize the messages that are sent to the email addresses you attempt to verify. For more information, see Using custom verification email templates.

To verify an email address identity

1. Check the inbox of the email address used to create your identity and look for an email from no-reply-aws@amazon.com.

2. Open the email and click the link to complete the verification process for the email address. After it's complete, the Identity status updates to Verified.

1. In a text editor, create a new file. Paste the following content into the editor:

   {
     "TemplateName": "SampleTemplate",
     "FromEmailAddress": "sender@example.com",
     "TemplateSubject": "Please confirm your email address",
     "TemplateContent": "<html>
                         <head></head>
                         <body style='font-family:sans-serif;'>
                           <h1 style='text-align:center'>Ready to start sending 
                           email with ProductName?</h1>
                           <p>We here at Example Corp are happy to have you on
                             board! There's just one last step to complete before
                             you can start sending email. Just click the following
                             link to verify your email address. Once we confirm that 
                             you're really you, we'll give you some additional 
                             information to help you get started with ProductName.</p>
                         </body>
                         </html>",
     "SuccessRedirectionURL": "https://www.example.com/verifysuccess",
     "FailureRedirectionURL": "https://www.example.com/verifyfailure"
   }

   Important

   To make the preceding example easier to read, the TemplateContent attribute contains line breaks. If you paste the preceding example into your text file, remove the line breaks before proceeding.

   Replace the values of TemplateName, FromEmailAddress, TemplateSubject, TemplateContent, SuccessRedirectionURL, and FailureRedirectionURL with your own values.

   Note

   The email address that you specify for the FromEmailAddress parameter has to be verified, or has to be an address on a verified domain. For more information, see Verified identities in Amazon SES.

   When you finish, save the file as customverificationemail.json.

2. At the command line, type the following command to create the custom verification email template:

   aws sesv2 create-custom-verification-email-template --cli-input-json file://customverificationemail.json

3. (Optional) You can confirm that the template was created by typing the following command:

   aws sesv2 list-custom-verification-email-templates