Adding DMARC, SPF, and DKIM records in AWS Route 53

The shortcut: connect once, never touch the console

Route 53 is one of the providers trustyourinbox can write to directly. If you connect a scoped, API-only IAM user, the one-click DMARC, SPF, DKIM, and TLS-RPT fixes we offer write straight to it: a five-minute hold you can cancel, a read back from public DNS after the write, and an undo for any change to an existing record. Connecting Route 53 takes a few minutes and is the path we recommend. The rest of this guide is for when you would rather publish records by hand.

Before you start: confirm Route 53 answers your DNS

Route 53 assigns each hosted zone four nameservers spread across four top-level domains (.com, .net, .org, .co.uk) for resilience, looking like ns-2048.awsdns-64.com. Confirm your domain is delegated to them:

dig +short NS yourdomain.com

If the answers contain awsdns, you are in the right place. If not, the zone you are editing is not the one answering live queries.

Step 1: Open the hosted zone

1. Open the Route 53 console.
2. In the navigation pane choose Hosted zones.
3. Choose the name of the hosted zone for your domain.
4. Choose Create record. Keep the default Simple routing (the weighted and latency policies are for load balancing, never for email-auth records).

Step 2: Create the record

Two Route 53 rules govern every record below. First, wrap the value in double quotes in the Value box. Second, for the apex (your SPF record), leave the Record name field blank. Do not type @; AWS's own guidance is not to enter any value there. The grayed suffix already shows your domain, so you type only the prefix for everything else.

DMARC

Record name: _dmarc
Record type: TXT
Value:       "v=DMARC1; p=none; rua=mailto:you@yourdomain.com"
TTL:         300

Start at p=none, then move past p=none once your reports are clean. The quotes are part of what you paste.

SPF

Record name: (leave blank for the apex)
Record type: TXT
Value:       "v=spf1 include:_spf.yourprovider.com ~all"
TTL:         300

Publish only one v=spf1 record. If the apex already has a TXT record with an SPF string, edit that record rather than adding a second. Our SPF builder keeps you under the ten-lookup limit.

DKIM (the multi-string part)

A single TXT string maxes out at 255 characters, and a 2048-bit DKIM key is longer than that. Route 53 does not split it for you, so you break the key into chunks of 255 or fewer, wrap each chunk in its own double quotes, and put them all on one line separated by spaces:

Record name: selector._domainkey
Record type: TXT
Value:       "v=DKIM1; k=rsa; p=MIIBIjANBgkq...first255" "...rest of the key"
TTL:         300

The strings concatenate back together at lookup time. The chunks of one key go on a single line separated by spaces, not on separate rows (separate rows would be separate TXT records). The total value can be up to 4000 characters.

MTA-STS pointer

Record name: _mta-sts
Record type: TXT
Value:       "v=STSv1; id=20260623000000"
TTL:         300

This is the pointer only. The policy file is served over HTTPS at mta-sts.yourdomain.com; you publish that file yourself, and the MTA-STS tab in trustyourinbox shows the exact file. TLS-RPT (_smtp._tls) follows the same quoted-TXT shape.

When everything is filled in, choose Create records (the final button is plural).

Route 53 quirks that bite

• Forgetting the quotes. An unquoted TXT value either errors or stores wrong. Every value goes in double quotes.
• Typing @ for the apex. Leave Record name blank instead. AWS says not to enter a value such as @ for a record with the same name as the zone.
• Splitting a DKIM key across rows. Chunks of one key are space-separated on one line. Separate rows create separate records.
• Picking a long initial TTL. 300 seconds keeps corrections fast while you test. Raise it once the records are stable.

Least-privilege IAM (if you script it)

Editing records needs four actions: route53:ListHostedZones to find the zone, route53:ListResourceRecordSets and route53:ChangeResourceRecordSets on the hosted-zone ARN (arn:aws:route53:::hostedzone/YOUR_ZONE_ID), and route53:GetChange to confirm the write landed. The managed AmazonRoute53FullAccess policy is the easy path but grants everything across every zone; a scoped customer-managed policy is the least-privilege choice. That same scoped policy is what our one-click connection asks for.

Step 3: Verify it published

dig +short TXT _dmarc.yourdomain.com
dig +short TXT yourdomain.com | grep spf1
dig +short TXT selector._domainkey.yourdomain.com

Or paste the hostname into dns.google with type TXT. The double quotes you entered will not appear in the lookup output; resolvers strip them, which is expected.

Tell trustyourinbox to recheck

Each protocol tab (DMARC, SPF, DKIM, MTA-STS) has a Scan now button. Click it once the Route 53 change resolves. We read the record again from public DNS and refresh the page.