--- title: "A Step-by-Step Guide For Adding SPF, DKIM, and DMARC Records to AWS DNS-Route 53 | DuoCircle" description: "A Step-by-Step Guide For Adding SPF, DKIM, and DMARC Records to AWS DNS-Route 53." image: "https://www.duocircle.com/images/og-default.png" canonical: "https://www.duocircle.com/blog/email-security/how-to-add-spf-dkim-dmarc-records-aws-route-53/" --- Quick Answer Before adding records to Route 53, check that no duplicate SPF, DKIM, or DMARC records already exist on the domain; duplicates invalidate authentication. To add SPF: log in to Route 53, open DNS Management, select the domain, click Create Record, set type to TXT, leave Record Name blank, and paste the record (for example, v=spf1 ip4:169.134.174.23/32 include:yourdomain.com \~all). Multiple SPF records for one domain are not allowed; merge them with include. To add DKIM: get the type, name, and value from your email service provider (each ESP has its own keys), then create a TXT record using those exact values, for example default.\_domainkey.example.com with v=DKIM1; k=rsa; p=. Verify with a DKIM checker. To add DMARC: generate the record (start at p=none for monitoring), then create a TXT record at \_dmarc.yourdomain.com with the policy and rua/ruf addresses. Advance from none to quarantine to reject as reports confirm alignment. A Step-by-Step Guide For Adding SPF, DKIM, and DMARC Records to AWS DNS-Route 53 Your browser does not support the audio element. [ Download episode](https://media.mailhop.org/duocircle/images/2024/06/A-Step-by-Step-Guide-For-Adding-SPF-DKIM-and-DMARC-Records-to-AWS-DNS-Route-53.mp3) Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Femail-security%2Fhow-to-add-spf-dkim-dmarc-records-aws-route-53%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=A%20Step-by-Step%20Guide%20For%20Adding%20SPF%2C%20DKIM%2C%20and%20DMARC%20Records%20to%20AWS%20DNS-Route%2053&url=undefined%2Fblog%2Femail-security%2Fhow-to-add-spf-dkim-dmarc-records-aws-route-53%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Femail-security%2Fhow-to-add-spf-dkim-dmarc-records-aws-route-53%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Femail-security%2Fhow-to-add-spf-dkim-dmarc-records-aws-route-53%2F&title=A%20Step-by-Step%20Guide%20For%20Adding%20SPF%2C%20DKIM%2C%20and%20DMARC%20Records%20to%20AWS%20DNS-Route%2053 "Share on Reddit") [ ](mailto:?subject=A%20Step-by-Step%20Guide%20For%20Adding%20SPF%2C%20DKIM%2C%20and%20DMARC%20Records%20to%20AWS%20DNS-Route%2053&body=Check out this article: undefined%2Fblog%2Femail-security%2Fhow-to-add-spf-dkim-dmarc-records-aws-route-53%2F "Share via Email") ![DMARC Records](https://media.mailhop.org/duocircle/images/2024/06/dmarc-report-8956.jpg) Before you follow these steps, check if your [domain’s DNS](https://www.techtarget.com/searchnetworking/definition/domain-name-system) already has the SPF, DKIM, and DMARC records. **Redundancies make all your records invalid**, neglecting the responsibility of these email authenticating agents. You can use online SPF, DKIM, and [DMARC](/email/dmarc) record lookup tools designed for [email security](/) assessment to ascertain this; _all you have to do is enter your **domain name and the type of record** you want it to evaluate for you._ ## Adding an SPF Record to AWS DNS-Route 53 Here’s what you need to do- 1. Log in to your [Amazon Route 53](https://aws.amazon.com/route53/) account. 2. Go to the Route 53 ‘Dashboard’ section and then go to ‘**DNS Management**’ under it and choose the domain for which you want to add an SPF record. 3. Next, click on ‘**create record**.’ 4. Add your SPF record type as ‘**TXT**.’ _Don’t enter anything in the ‘Record Name’ section_. 5. Add the IP addresses to the same [SPF record](/content/spf-records/spf-record-example) if you use sources with only IP addresses. 6. **Finish the process** by clicking ‘Create Record.’ Ensure your SPF record looks something like this- `_v=spf1 ip4:169.134.174.23/32 include:yourdomain.com ~all_` Also note that [multiple SPF records](/content/spf-too-many-dns-lookups/multiple-spf-records) corresponding to a domain shouldn’t exist, as this leads to authentication failure. If there is more than one SPF record, use the **‘include’ mechanism** to merge them into one. [![DNS management](https://media.mailhop.org/duocircle/images/2024/06/Office-365-migration-3.jpg)](https://media.mailhop.org/duocircle/images/2024/06/Office-365-migration-3.jpg) ## Adding a DKIM Record to AWS DNS-Route 53 Before we talk about how to add a [DKIM](/resources/what-is-dkim) record to your Amazon Route 53, you should know that each email service provider has **its own DKIM key pairs**. So, go to your account first and retrieve the record details (type, name, and value). Once done, follow these steps- 1. Log in to your Amazon Route 53 account. 2. Go to the Route 53 ‘Dashboard’ section and then go to ‘DNS Management’ under it and **choose the domain** for which you want to add a DKIM record. 3. Next, click on ‘**create record**.’ 4. Add your [DKIM Record](https://www.cloudflare.com/learning/dns/dns-records/dns-dkim-record/) Type, Record Name, and Value. 5. Finish the process by clicking ‘Create Record.’ 6. Run it through a [DKIM lookup tool](/resources/dkim-checker) to **ensure it’s working properly**. Ensure your DKIM record looks something like this- `_default._domainkey.example.com. IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADC_` `_BiQKBgQD2GjmTSwzE7/Uoqv4RQmhs6vRk/_` `_JuKknj2+2QsUNNY0XsbO4Xwef13r_` `_DfsK0m5dPsbZbxFPxyYfjHY1HyH4ycqIkMXbT8pQu5MGJ64aIbw/_` `_2UIJpjbF9pKxppRmJHQlO5zXq5Etc2+MoO9K1zh_` `_YvHbFgRUIe3DfiJAvXjGYdLtqwIDAQAB"_` [![DMARC record generator](https://media.mailhop.org/duocircle/images/2024/06/dmarc-report-service-7635.jpg)](https://media.mailhop.org/duocircle/images/2024/06/dmarc-report-service-7635.jpg) ## Adding a DMARC Record to AWS DNS-Route 53 The process is more or less similar to what you did for SPF and DKIM. 1. Generate your DMARC record using an online [DMARC record generator](/resources/dmarc-record-generator) and copy the DMARC Record **Type, Record Name, and Value**. 2. After generating the DMARC record, go to your Amazon Route 53 account and click ‘**Create Record**.’ 3. _Add your DMARC Record Type, Record Name, and Value to the corresponding fields_. Your DMARC record should look something like this- `_v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com; ruf=mailto:dmarc-failures@yourdomain_` _We recommend starting your DMARC setup in ‘[Monitoring’ mode](/dmarc/a-guide-to-advancing-dmarc-policies-for-enhanced-email-deliverability/) (p=none)_. This allows you to gather reports and identify legitimate email servers in your organization. Once you’re confident in your configurations, you can **enforce stricter policies** like ‘Quarantine’ and ‘Reject.’ [Reach out to us](/contact) to help you with the above processes or anything else related to email authentication through [SPF](/content/spf-record-check), DKIM, and DMARC. We have a team of **tech ninjas to serve you** with the best. ## Topics DMARCemail securityUpdates ![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) Brad Slavin General Manager General Manager at DuoCircle. Product strategy and commercial lead across the email security portfolio. ## Secure your email infrastructure Protect, authenticate, and deliver. Contact our team to find the right solution. [Contact Sales](/contact/) [Explore Products](/products/) ## Related Articles [ Email Security 8m Best Practices to Follow When Implementing SPF, DKIM, and DMARC Mar 19, 2024 ](/blog/email-security/best-practices-to-follow-when-implementing-spf-dkim-and-dmarc/)[ Email Security 3m Best Ways to Secure Emails in 2024 Apr 26, 2024 ](/blog/email-security/best-ways-to-secure-emails-in-2024/)[ Email Security 6m Comparison Between SPF, DKIM, and DMARC Nov 16, 2023 ](/blog/email-security/comparison-between-spf-dkim-and-dmarc/)[ Email Security 8m Configuring DKIM to sign mail from your Microsoft 365 domain Jun 27, 2024 ](/blog/email-security/configuring-dkim-sign-mail-from-your-microsoft-365-domain/) ```json {"@context":"https://schema.org","@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}],"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://www.g2.com/products/phish-protection-by-duocircle/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://support.duocircle.com"},"knowsAbout":["Email Security","Email Authentication","SPF","DKIM","DMARC","Phishing Protection","Spam Filtering","SMTP Relay","Email Deliverability","Email Forwarding"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"DuoCircle LLC","url":"https://www.duocircle.com","description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}} ``` ```json [{"@context":"https://schema.org","@type":"BlogPosting","headline":"A Step-by-Step Guide For Adding SPF, DKIM, and DMARC Records to AWS DNS-Route 53","description":"A Step-by-Step Guide For Adding SPF, DKIM, and DMARC Records to AWS DNS-Route 53.","url":"https://www.duocircle.com/blog/email-security/how-to-add-spf-dkim-dmarc-records-aws-route-53/","datePublished":"2024-06-13T20:26:46.000Z","dateModified":"2025-05-24T17:17:43.000Z","dateCreated":"2024-06-13T20:26:46.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/email-security/how-to-add-spf-dkim-dmarc-records-aws-route-53/"},"articleSection":"email-security","keywords":"DMARC, email security, Updates","wordCount":535,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2024/06/dmarc-report-8956.jpg","caption":"DMARC Records","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":2,"name":"Email Security"},{"@type":"ListItem","position":3,"name":"A Step-by-Step Guide For Adding SPF, DKIM, and DMARC Records to AWS DNS-Route 53","item":"https://www.duocircle.com/blog/email-security/how-to-add-spf-dkim-dmarc-records-aws-route-53/"}]}] ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://www.duocircle.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":3,"name":"Email Security","item":"https://www.duocircle.comundefined"},{"@type":"ListItem","position":4,"name":"A Step-by-Step Guide For Adding SPF, DKIM, and DMARC Records to AWS DNS-Route 53","item":"https://www.duocircle.com/blog/email-security/how-to-add-spf-dkim-dmarc-records-aws-route-53/"}]} ``` ```json {"@context":"https://schema.org","@type":"BlogPosting","headline":"A Step-by-Step Guide For Adding SPF, DKIM, and DMARC Records to AWS DNS-Route 53","description":"A Step-by-Step Guide For Adding SPF, DKIM, and DMARC Records to AWS DNS-Route 53.","url":"https://www.duocircle.com/blog/email-security/how-to-add-spf-dkim-dmarc-records-aws-route-53/","datePublished":"2024-06-13T20:26:46.000Z","dateModified":"2025-05-24T17:17:43.000Z","dateCreated":"2024-06-13T20:26:46.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/email-security/how-to-add-spf-dkim-dmarc-records-aws-route-53/"},"articleSection":"email-security","keywords":"DMARC, email security, Updates","wordCount":535,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2024/06/dmarc-report-8956.jpg","caption":"DMARC Records","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}} ```