The Ultimate Guide to Amazon SES Setup with GoDaddy DNS

Introduction

A Complete Zero-to-100% Implementation & Technical Deliverability Manual

Setting up Amazon Simple Email Service (SES) with GoDaddy as your domain registrar is one of the most cost-effective ways to deliver transactional and marketing emails at scale. However, misconfiguring your email authentication protocols such as DKIM, SPF, or DMARC can send your critical messages straight to spam folders or cause recipient servers to reject them entirely. This is exactly the kind of issue our AWS cloud security and compliance team helps production environments avoid.

This comprehensive guide provides an end-to-end operational walkthrough to set up AWS SES from scratch, extract the precise DNS records, avoid GoDaddy-specific formatting pitfalls, configure strict authentication protocols, and request exit from the AWS SES Sandbox into full production. For teams that prefer professional DevOps services to handle this setup, this walkthrough also serves as a reference for what the implementation involves.

Key Architectural Protocols & Prerequisites

Before configuring DNS records, it is critical to understand the four underlying protocols that secure your email domain and guarantee deliverability:

Step-by-Step Implementation Guide

Step 1: Create and Configure Domain Identity in AWS SES

1. Log in to the AWS Management Console and search for Amazon Simple Email Service (SES).

2. In the left navigation sidebar under Configuration, select Identities.

3. Click Create identity.

4. Select Domain as the Identity type.

5. Enter your root domain name (e.g., yourdomain.com).

6. Check Custom MAIL FROM domain (Highly Recommended):

• Check Use a custom MAIL FROM domain.
• Enter a dedicated subdomain prefix such as mail or bounce (e.g., mail.yourdomain.com).
• Under Behavior on MX failure, choose Reject message to enforce strict alignment.
• Uncheck publish DNS records to Route53

7. Expand Advanced DKIM settings:

• Select Easy DKIM.
• Choose RSA_2048_BIT for the DKIM signing key length (recommended for widespread mail client compatibility).
• Uncheck publish DNS records to Route53
• Keep DKIM signatures Enabled.

8. Click Create identity at the bottom of the page.

Step 2: Retrieve the Generated DNS Records from AWS

Once created, open the Get set up page from the left menu in AWS SES and click Get DNS Records button. You will be presented with the following required DNS records:

• 3 CNAME Records for Easy DKIM (e.g., [token1]._domainkey.yourdomain.com pointing to [token1].dkim.amazonses.com).
• 1 MX Record for Custom MAIL FROM (e.g., mail.yourdomain.com pointing to feedback-smtp.[region].amazonses.com with priority 10).
• 1 TXT Record for Custom MAIL FROM SPF (e.g., mail.yourdomain.com with value "v=spf1 include:amazonses.com ~all").
• 1 TXT Record DMARC (e.g., _dmarc.yourdomain.com with value "v=DMARC1; p=none;").

Step 3: Add DNS Records in GoDaddy DNS Management

Navigate to your GoDaddy Domain Portfolio, click your domain, select DNS, and add the following 6 records:

Step 4: Verify Propagation and AWS Identity Status

DNS changes typically propagate within 15 minutes, though GoDaddy can occasionally take up to a few hours. Return to the AWS SES Console and confirm:

• Identity status: Verified (Green badge)
• DKIM status: Successful
• MAIL FROM status: Successful

Step 5: Request Production Access (Exiting the SES Sandbox)

All new AWS SES accounts are placed in the SES Sandbox to prevent abuse. In Sandbox mode, you can only send emails to verified recipient addresses, and daily limits are restricted to 200 messages per 24 hours.

To move into Production:

• In AWS SES Console, navigate to Get Set up page.
• Click Request production access.
• Select your Mail Type (Transactional vs. Marketing).
• Enter your active website URL.
• Provide a detailed Use Case Description explaining how you collect opt-ins, handle bounce/complaint notifications, and process unsubscribes.
• Submit the request (AWS review typically takes 24–48 hours).

Deliverability & Anti-Spam Technical Checklist

DNS Verification via Command Line (Terminal / CMD)

You can verify that your DNS records have successfully propagated using the dig command line tool before checking AWS:

# 1. Verify DKIM CNAME Record propagation
dig CNAME token1._domainkey.yourdomain.com +short

# 2. Verify Custom MAIL FROM SPF Record
dig TXT mail.yourdomain.com +short

# 3. Verify DMARC TXT Record
dig TXT _dmarc.yourdomain.com +short