Sendy SPF and DKIM setup

What you are setting up

Sendy is a PHP application you install on your own server, bought with a one-time license, and it does not run a mail server of its own. You give it an AWS access key pair under Settings > Amazon Web Services Credentials, and from then on every campaign, autoresponder, and test send is handed to Amazon SES, which also feeds bounces and complaints back through Amazon SNS. That has one consequence for authentication: Sendy signs nothing and publishes nothing. The DKIM signature on a Sendy message comes from the SES identity for your domain, the Return-Path is whatever SES sets, and the DNS records you publish are the same ones any SES customer publishes. Sendy's own troubleshooting page says as much: its deliverability advice is four links into the Amazon SES documentation for DKIM, DMARC, custom MAIL FROM, and SPF, with the note that a custom MAIL FROM domain is optional and that SPF is only needed if you set one up.

Publish SPF and DKIM

Start in the Amazon SES console, and check the region selector first: Sendy sends from the Amazon SES region chosen in its main Settings (the main admin login sees it; a brand user does not), and SES identities are verified per region, so you must create the identity in that same region. Go to Configuration > Identities > Create identity, choose Domain, enter your sending domain without any www. prefix, and leave Easy DKIM enabled with the default 2048-bit key. SES then lists three CNAME records under the identity's Authentication tab, in the Publish DNS records panel. The shape is:

Type:  CNAME
Host:  <token1>._domainkey.yourdomain.com
Value: <token1>.dkim.amazonses.com

(plus two more, with token2 and token3)

The tokens are unique to your identity and the target's hosted zone varies by region and cell (some identities get a value such as <token>.<cell>.dkim.<region>.amazonses.com), so copy the three values from your own console rather than from this page. Enter the host exactly as shown, with the underscore and with no extra leading underscore, and do not let your DNS host append your domain a second time. SES checks for up to 72 hours; when it finds all three, the identity's DKIM configuration reads Successful and its Identity status reads Verified. Those three CNAMEs do double duty: they prove you own the domain and they are the DKIM keys, so from that moment SES signs Sendy mail with d=yourdomain.com, and any address on the domain can be a Sendy From email without verifying it separately.

That is the whole DKIM setup. SPF is the optional half, and it only matters if you want the Return-Path on your own domain. By default SES uses a subdomain of amazonses.com as the MAIL FROM, so SPF passes for Amazon and does not align with your From domain. To change that, open the verified identity, scroll to Custom MAIL FROM domain, choose Edit, tick Use a custom MAIL FROM domain, and enter a subdomain you use for nothing else, such as bounce.yourdomain.com. SES then shows two records:

Type:  MX     (publish exactly ONE MX on this subdomain)
Host:  bounce.yourdomain.com
Value: 10 feedback-smtp.<your-region>.amazonses.com

Type:  TXT
Host:  bounce.yourdomain.com
Value: v=spf1 include:amazonses.com ~all

The feedback-smtp hostname is region-specific and SES fills it in for you. Leave Behavior on MX failure on Use default MAIL FROM domain unless you want a missing MX to reject the whole campaign. Then finish in Sendy: every brand has its own From email, and each one must sit on the domain you just verified. Sendy's developer gives the same answer in the forum whenever DKIM and SPF pass but DMARC fails: the From email in Sendy has to use the domain verified in Amazon SES.

Add DMARC

Neither Sendy nor SES publishes DMARC for you. It goes at your root domain as a standard _dmarc TXT record, and it covers the custom MAIL FROM subdomain too:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Sendy's forum guidance jumps straight to p=quarantine; start at p=none instead, read a few weeks of reports, and progress past p=none once every legitimate source is aligned. Two alignment notes from the SES side: keep SPF alignment relaxed (no aspf=s), or the custom MAIL FROM subdomain stops counting, and if a brand's From email sits on a subdomain of the verified domain, keep DKIM alignment relaxed as well (no adkim=s), because the signature carries the identity's exact domain. Build the record with our DMARC builder.

The Sendy gotcha

The records are SES's, not Sendy's. Nothing in the Sendy interface publishes DNS, signs mail, or shows a DKIM status, so a search for a Sendy record to add finds nothing, and the answer to every “Sendy DKIM” question is the SES identity for the domain. That also means the failure modes are SES failure modes. A MessageRejected error saying an address is not verified is SES refusing a From email whose domain is verified in a different region than the one Sendy is set to, or not at all. A new AWS account is in the SES sandbox, where you can only send to addresses you have verified and only 200 messages a day, so a campaign that reaches your own inbox and nobody else's is a sandbox account, not an authentication problem. Sendy's password-reset email fails for the same reason if the admin login's address is not on a verified identity.

A verified address is not a verified domain. Agencies running several brands often verify each client's From address as an email-address identity in SES, because that only takes a click in the client's inbox. It sends, but SES cannot sign with the client's domain, so the message carries no aligned DKIM, mail clients show “via amazonses.com,” and the client's DMARC reports record Sendy as an unauthenticated source. Verify the client's domain with the three CNAMEs instead; the same applies to a personal webmail From address, which Sendy's forum already warns against. Finally, until you add a custom MAIL FROM, the Return-Path on every Sendy message is a long bounce address at <region>.amazonses.com, so a DMARC report tool that says “SPF not aligned” while Gmail says SPF passed is describing the same message correctly from two angles. DKIM is carrying alignment, which is fine; the custom MAIL FROM is what makes SPF align too.

Confirm it worked

• Check the SES identity. In the region Sendy uses, the domain should show Identity status Verified and DKIM configuration Successful, and if you added a custom MAIL FROM, its state should read Success rather than Pending. Our DKIM checker confirms the three CNAMEs resolve.
• Send a campaign to yourself and read the headers. Sendy's test send goes through the same SES path as a real campaign, so it is a fair test. Confirm the DKIM signature shows d=yourdomain.com, the Return-Path is on your custom MAIL FROM subdomain (or on amazonses.com if you skipped that step), and the result is dmarc=pass. Our header analyzer reads it back plainly.
• Watch the reports. Sendy mail appears in your DMARC aggregate reports as Amazon SES infrastructure, DKIM-aligned and passing, and trustyourinbox labels it as Amazon SES rather than Sendy because the reports only see the sending service. A row from SES that passes SPF for amazonses.com but carries no DKIM for your domain is a brand whose From email is on an address-only identity.