Managing Easy DKIM and BYODKIM

To obtain the DKIM records for an identity by using the console

1. Sign in to the AWS Management Console and open the Amazon SES console at https://console.aws.amazon.com/ses/.

2. In the navigation pane, under Configuration, choose Verified identities.

3. In the list of identities, choose the identity for which you want to obtain DKIM records.

4. On the Authentication tab of the identity details page, expand View DNS records.

5. Copy either the three CNAME records if you used Easy DKIM, or the TXT record if you used BYODKIM, that appear in this section. Alternatively, you can choose Download .csv record set to save a copy of the records to your computer.

   The following image shows an example of the expanded View DNS records section revealing CNAME records associated with Easy DKIM.

   

To obtain the DKIM records for an identity by using the AWS CLI

1. At the command line, type the following command:

   aws ses get-identity-dkim-attributes --identities "example.com"

   In the preceding example, replace example.com with the identity that you want to obtain DKIM records for. You can specify either an email address or a domain.

2. The output of this command contains a DkimTokens section, as shown in the following example:

   {
       "DkimAttributes": {
           "example.com": {
               "DkimEnabled": true,
               "DkimVerificationStatus": "Success",
               "DkimTokens": [
                   "hirjd4exampled5477y22yd23ettobi",
                   "v3rnz522czcl46quexamplek3efo5o6x",
                   "y4examplexbhyhnsjcmtvzotfvqjmdqoj"
               ]
           }
       }
   }

   You can use the tokens to create the CNAME records that you add to the DNS settings for your domain. To create the CNAME records, use the following template:

   token1._domainkey.example.com CNAME token1.dkim.amazonses.com
   token2._domainkey.example.com CNAME token2.dkim.amazonses.com
   token3._domainkey.example.com CNAME token3.dkim.amazonses.com

   Replace each instance of token1 with the first token in the list you received when you ran the get-identity-dkim-attributes command, replace all instances of token2 with the second token in the list, and replace all instances of token3 with the third token in the list.

   For example, applying this template to the tokens shown in the preceding example produces the following records:

   hirjd4exampled5477y22yd23ettobi._domainkey.example.com CNAME hirjd4exampled5477y22yd23ettobi.dkim.amazonses.com
   v3rnz522czcl46quexamplek3efo5o6x._domainkey.example.com CNAME v3rnz522czcl46quexamplek3efo5o6x.dkim.amazonses.com
   y4examplexbhyhnsjcmtvzotfvqjmdqoj._domainkey.example.com CNAME y4examplexbhyhnsjcmtvzotfvqjmdqoj.dkim.amazonses.com

To disable DKIM for an identity

1. Sign in to the AWS Management Console and open the Amazon SES console at https://console.aws.amazon.com/ses/.

2. In the navigation pane, under Configuration, choose Verified identities.

3. In the list of identities, choose the identity for which you want to disable DKIM.

4. Under the Authentication tab, in the DomainKeys Identified Mail (DKIM) container, choose Edit.

5. In Advanced DKIM settings, clear the Enabled box in the DKIM signatures field.

To disable DKIM for an identity by using the AWS CLI

• At the command line, type the following command:

  aws ses set-identity-dkim-enabled --identity example.com --no-dkim-enabled

  In the preceding example, replace example.com with the identity that you want to disable DKIM for. You can specify either an email address or a domain.

To enable DKIM for an identity

1. Sign in to the AWS Management Console and open the Amazon SES console at https://console.aws.amazon.com/ses/.

2. In the navigation pane, under Configuration, choose Verified identities.

3. In the list of identities, choose the identity for which you want to enable DKIM.

4. Under the Authentication tab, in the DomainKeys Identified Mail (DKIM) container, choose Edit.

5. In Advanced DKIM settings, check the Enabled box in the DKIM signatures field.

To enable DKIM for an identity by using the AWS CLI

• At the command line, type the following command:

  aws ses set-identity-dkim-enabled --identity example.com --dkim-enabled

  In the preceding example, replace example.com with the identity that you want to enable DKIM for. You can specify either an email address or a domain.

To disable/enable DKIM signing for an email address identity using the console

1. Sign in to the AWS Management Console and open the Amazon SES console at https://console.aws.amazon.com/ses/.

2. In the navigation pane, under Configuration, choose Verified identities.

3. In the list of identities, choose an identity where the Identity type is Email address and belongs to one of your verified domains.

4. Under the Authentication tab, in the DomainKeys Identified Mail (DKIM) container, choose Edit.

   Note

   The Authentication tab is only present if the selected email address identity belongs to a domain that has already been verified by SES. If you haven't verified your domain yet, see Creating a domain identity.

5. Under Advanced DKIM settings, in the DKIM signatures field, clear the Enabled checkbox to disable DKIM signing, or select it to re-enable DKIM signing (if it had been overridden previously).

6. Choose Save changes.

To disable/enable DKIM signing for an email address identity using the AWS CLI

• Assuming you own the example.com domain, and you want to disable DKIM signing for one of the domain's email addresses, at the command line, type the following command:

  aws sesv2 put-email-identity-dkim-attributes --email-identity marketing@example.com --no-signing-enabled

  1. Replace marketing@example.com with the email address identity that you want to disable DKIM signing for.

  2. --no-signing-enabled will disable DKIM signing. To re-enable DKIM signing, use --signing-enabled.