uSend Docs
DNS provider guides

Amazon Route 53

Add the DKIM, return-path and DMARC records usend shows in Amazon Route 53.

This page shows where the records go in Amazon Route 53 and its quirks. Menu labels change over time; if yours differ, look for the DNS records list of the domain.

Before you start

  1. Add the domain in usend (Domains, or POST /domains). usend shows the exact records for it, and the values are unique to your domain, so copy them from there.
  2. Find where the domain's DNS is hosted. DNS is edited at whoever runs the domain's nameservers, which is not always the registrar you bought it from. If it is not Amazon Route 53, follow that provider's guide instead.

The records

usend shows this set of records. Names are relative to your domain, acme.com in the example.

RecordNameTypeValue
DKIMrs1._domainkeyTXTv=DKIM1; k=rsa; p=MIIB... (long, unique to your domain)
Return path and SPFsend and/or send-sesCNAMEthe host usend shows, for example rp-ses-us-east-1.usend.et
DMARC (recommended)_dmarcTXTv=DMARC1; p=none;
Receiving (only if you enabled it)@MXthe host usend shows, priority 10

The domain's page lists one return-path CNAME for each sending transport enabled on usend, so you may see send, send-ses or both. Add every one that is shown. The MX and SPF records for the return path live behind that CNAME, so you do not add a separate MX or SPF record for sending, and your own SPF record at the root does not need to change. See Custom return path to choose another label, and DMARC before you tighten the policy.

Warning

Only add the receiving MX record if you turned on receiving. An MX at the root sends all mail for that name to usend. Use a dedicated subdomain if the domain already receives mail elsewhere.

Add them in Amazon Route 53

Open the Route 53 console, choose Hosted zones, and open the hosted zone of your domain (it must be the zone your registrar's nameservers point to).

Choose Create record, pick Simple routing if asked, then Define simple record. Choose the record type, enter the Record name and the Value, and create the record. You can add several records in one wizard with Add another record.

Route 53 shows the record name without the domain: enter rs1._domainkey and it becomes rs1._domainkey.acme.com. Leave the name empty for the domain itself.

Add the DKIM TXT record, each return-path CNAME and the DMARC TXT record.

Amazon Route 53-specific notes

  • For a TXT value, Route 53 requires the value in double quotes. Wrap the DKIM value in quotes: "v=DKIM1; k=rsa; p=MIIB...". Values longer than 255 characters must be split into several quoted strings on one line, for example "first part..." "second part...". usend joins them back when it verifies.
  • Keep the CNAME as a plain record. Do not use an Alias record for the return path: aliases are for AWS resources and are not CNAMEs.
  • The same steps work with the CLI: aws route53 change-resource-record-sets --hosted-zone-id Z123 --change-batch file://records.json.
  • If your domain already has a DMARC record, keep it: you only need one, and usend accepts any record that starts with v=DMARC1.

Verify

Back in usend, press Verify on the domain (or POST /domains/{id}/verify). usend checks with public DNS resolvers, so it sees what other mail servers see. Records usually show up within minutes; some providers take longer. Each record gets its own status, and usend keeps re-checking for 24 hours.

If a record stays pending or failed, see Domain not verifying. Background: Verify a domain.