Registrar

Email Authentication on AWS Route 53

Route 53 has a specific TXT record format — values must be wrapped in quotes. Here's how to add SPF, DKIM, DMARC, and MX records correctly.

Hosted zones live under Route 53 → Hosted Zones → your domain. Root is a blank record name — not @. Turn on DNSSEC from the hosted zone when you're ready.

SPF record

One v=spf1 TXT at root — merge providers.

→

DKIM record

TXT at selector._domainkey — paste full key.

→

DMARC setup

TXT at _dmarc — start with p=none.

→

MX record

Priorities, hostnames, no proxy where applicable.

→

DNSSEC

Signing keys in the hosted zone.

→