Sender Identity

Home · Guides · Route 53

DNS · AWS Route 53

Route 53: hosted-zone records for mail authentication.

22 October 2026

Create records in the hosted zone that answers for the organizational domain. Route 53 quotes TXT values; paste the SPF or DMARC string as one value. Do not use an Alias target for _dmarc—use a plain CNAME when delegating to Hosted DMARC.

Publish records

  1. Open Route 53 → Hosted zones → your domain.
  2. Create record: TXT at the apex (blank name) for SPF.
  3. Create record: CNAME or TXT at selector._domainkey.brand.example for each DKIM key the ESP issues.
  4. Create record: TXT at _dmarc.brand.example, or CNAME from _dmarc.brand.example to brand.example._dmarc.hosted.senderidentity.com.
  5. Set TTL deliberately (300 is fine while testing).

Hosted DMARC on this provider

If you use Sender Identity Hosted DMARC, delete the TXT at _dmarc and publish only this CNAME. We publish the DMARC TXT on our side, starting at p=none with rua at reports.senderidentity.com.

TypeName / hostValue / points toNote
CNAME_dmarc.brand.examplebrand.example._dmarc.hosted.senderidentity.comDNS only on Cloudflare. Remove any TXT at the same name.

After the CNAME resolves, open Account on the site, confirm delegation shows ready, and keep reading aggregate reports before you approve quarantine or reject.

Check the result

  1. Wait for DNS TTL (often 5 minutes to an hour).
  2. Run the free static audit on the domain.
  3. Confirm the DMARC check shows the policy you expect, and that a CNAME path is not blocked by a leftover TXT.