How to Set Up AWS Route 53 DNS Records for Email Marketing

You manage DNS records in Amazon Web Services through the Route 53 console. Route 53 provides low-latency DNS resolution and defaults to a TTL of 300 seconds (5 minutes). Unlike most consumer domain registrars, Route 53 enforces strict DNS syntax rules: you must enclose TXT values in double quotes, and you enter MX priorities on the same line as the mail server hostname.

Route 53 DNS navigation and nameserver check

To access your hosted zone in Route 53:

1. Sign in to the AWS Management Console and navigate to Route 53.
2. In the left navigation pane, click Hosted zones.
3. Select your domain name from the hosted zones list.

Before creating records, check the NS record created automatically in your hosted zone. Route 53 assigns four unique nameservers to every zone (such as ns-123.awsdns-45.com). Confirm that your domain registrar points to these exact four nameservers. If your domain registration is with an external registrar or another AWS account, records configured here will not resolve until the registrar’s delegation matches this hosted zone.

Adding a record in Route 53

1. In your hosted zone details page, click Create record.
2. Leave the Record name field blank for root domain records (such as SPF), or enter the prefix for subdomains (such as _dmarc or a DKIM selector).
3. Select the record type from the Record type dropdown (TXT, CNAME, or MX).
4. Enter the TTL (seconds). The default is 300.
5. Enter the target data in the Value box:
   • For TXT records, enclose the entire value in double quotation marks: "v=spf1 include:_spf.google.com ~all".
   • For CNAME records, enter the destination hostname.
   • For MX records, enter the priority integer followed by a space and the mail server hostname: 10 feedback-smtp.us-east-1.amazonses.com.
6. Click Create records.

Amazon details these syntax requirements in its Route 53 record formatting documentation.

Required authentication records

Receiving mail servers use these three records to verify that messages sent from your domain are authentic.

1. SPF (Sender Policy Framework)

• Record name: Leave blank (Route 53 applies blank names to the zone apex)
• Record type: TXT
• Value: Enclose the SPF string in double quotes:

  "v=spf1 include:_spf.google.com include:sendgrid.net ~all"

• TTL: 300

Route 53 lists a deprecated “SPF” record type in its dropdown menu. Modern mail servers evaluate SPF exclusively through TXT records. Always select TXT as the record type.

Merging multiple SPF records

A domain must only have one root SPF record. If you already have an SPF record for Amazon WorkMail, Google Workspace, or Microsoft 365, do not create a second record. Multiple SPF records cause receiving mail servers to return a PermError, which sends messages to spam or drops them entirely.

To merge your email marketing provider into an existing SPF record:

1. Locate the existing TXT record at your apex domain in the record list.
2. Click the radio button next to the record, then click Edit record.
3. Add your provider’s include: mechanism inside the quotation marks before the closing qualifier (~all or -all). For example:

   "v=spf1 include:_spf.google.com include:sendgrid.net ~all"

4. Click Save.

If an SPF string exceeds 255 characters, Route 53 requires you to divide the string into multiple quoted segments separated by a space on the same line: "v=spf1 ... first 255 chars..." "...remaining chars... ~all".

2. DKIM (DomainKeys Identified Mail)

Email platforms provide DKIM records in either CNAME or TXT format:

CNAME-based DKIM

Most modern email platforms (such as Klaviyo, Postmark, SendGrid, and Amazon SES) use CNAME records:

• Record name: The selector prefix without your domain, such as s1._domainkey
• Record type: CNAME
• Value: The target hostname provided by your email platform, such as s1.domainkey.example-esp.com
• TTL: 300

If your email service displays the full domain (such as s1._domainkey.yourdomain.com), enter only s1._domainkey in the Record name field. Route 53 displays your apex domain to the right of the input box.

TXT-based DKIM

Some platforms provide a raw public key string:

• Record name: The selector prefix, such as google._domainkey
• Record type: TXT
• Value: The public key string enclosed in double quotation marks:

  "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."

• TTL: 300

If a 2048-bit key exceeds 255 characters, split the key into two quoted strings separated by a space inside the Value box: "v=DKIM1; k=rsa; p=firstPart" "secondPart".

3. DMARC (Domain-based Message Authentication, Reporting, and Conformance)

• Record name: _dmarc
• Record type: TXT
• Value:

  "v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com; pct=100;"

• TTL: 300

Start with p=none to collect delivery reports without affecting message flow. Once SPF and DKIM authenticate consistently across all your sending services, update the policy tag to p=quarantine or p=reject.

Optional deliverability and branding records

These records configure custom subdomains for bounce handling and link tracking.

4. Custom return path (bounce domain) (optional)

• Record name: bounces (or the subdomain prefix specified in your platform settings)
• Record type: CNAME
• Value: The mail server hostname assigned by your email platform (such as pm.mtasv.net)
• TTL: 300

5. Branded tracking domain (optional)

• Record name: links (or track, click, or email as specified by your platform)
• Record type: CNAME
• Value: The tracking hostname assigned by your email platform
• TTL: 300

Setting up custom MX records (if required)

If your email marketing service requires dedicated MX records for inbound message processing, reply handling, or sending subdomains:

1. Click Create record.
2. Set the details:
   • Record name: Leave blank for the root domain, or enter mail if using a dedicated sending subdomain.
   • Record type: MX
   • Value: Enter the priority and mail server hostname separated by a space on a single line:

     10 feedback-smtp.us-east-1.amazonses.com

   • TTL: 300
3. Click Create records.

If you use Google Workspace or Microsoft 365 for your organization’s business mailboxes, do not overwrite your root MX records. Overwriting root MX records disrupts standard corporate email delivery. Only add MX records for dedicated subdomains unless you are switching your primary email system.

Verifying your DNS records

Route 53 updates authoritative nameservers within seconds. You can verify your records in Windows PowerShell using Resolve-DnsName:

Check SPF

Resolve-DnsName -Name yourdomain.com -Type TXT

Review the Strings column. Verify that only one SPF record is returned and that your sending service mechanism is present.

Check DMARC

Resolve-DnsName -Name _dmarc.yourdomain.com -Type TXT

Confirm that the output contains your v=DMARC1; p=... record.

Check DKIM

Replace s1 with your provider’s specific selector:

Resolve-DnsName -Name s1._domainkey.yourdomain.com -Type CNAME

If your platform uses TXT-based DKIM, change -Type CNAME to -Type TXT. The output will display your provider’s target hostname or public key.

Check tracking and bounce records (if configured)

Resolve-DnsName -Name bounces.yourdomain.com -Type CNAME

The NameHost column should point to your email platform’s destination address.

Check MX records (if configured)

Resolve-DnsName -Name yourdomain.com -Type MX

The NameExchange column should list your designated mail servers with their numerical priorities under Preference.

Common troubleshooting issues

Issue	Root cause	Solution
Route 53 console returns a syntax error when saving TXT	The TXT value was entered without surrounding double quotation marks.	Enclose the entire value in double quotes: "v=spf1 ... ~all".
Subdomain hostname is duplicated (_dmarc.yourdomain.com.yourdomain.com)	The full domain was typed into the Record name box.	Enter only the subdomain prefix (such as _dmarc). Route 53 appends the zone apex automatically.
SPF status shows PermError	Multiple TXT records start with v=spf1.	Edit the existing SPF record, merge all include: mechanisms into that single record, and delete any duplicates.
MX record fails to save	Priority and mail server were not formatted on a single line separated by a space.	Enter MX records in the format [Priority] [Mail Server] (such as 10 mail.example.com).
Records do not resolve externally	Domain registrar nameservers do not match the hosted zone NS record.	Compare the four nameservers assigned to your hosted zone with the delegation settings at your domain registrar.
TXT record is truncated or rejected (>255 characters)	A long DKIM key was pasted as a single continuous string over 255 characters.	Split the string into multiple quoted substrings separated by a space on the same line: "part1" "part2".