Home · Guides · Transactional ESPs

Quickstart · Transactional ESPs

Transactional email authentication: Amazon SES, SendGrid & Postmark with DMARC

22 October 2026

Receipts, password resets, and invoices usually leave through SES, SendGrid, or Postmark. Each platform wants DKIM CNAMEs on your domain. Publish them, keep one SPF TXT under the lookup cap, then watch DMARC reports before you tighten policy.

Amazon SES

1. SES → Verified identities → domain → enable Easy DKIM (three CNAMEs).
2. Publish all three; wait until the identity is verified.
3. Merge include:amazonses.com into SPF if the envelope domain needs it.

SendGrid

1. Settings → Sender Authentication → Authenticate Your Domain.
2. Publish every CNAME SendGrid lists; automated validation must pass.
3. Prefer CNAME-based auth over stacking extra SPF includes when the UI offers both.

Postmark

1. Sender Signatures / Domains → open the domain.
2. Publish the DKIM CNAME and the Return-Path CNAME Postmark shows.
3. Wait for Postmark to mark DNS verified before production sends.

DMARC and lookup budget

Stacking Google + Microsoft + three transactional includes is how teams hit SPF_LOOKUP_LIMIT. Prefer DKIM alignment for ESPs, split marketing to a subdomain with its own SPF, or use paid Flatten SPF on the domain card after Hosted DMARC is active.

Platform detail: SES, SendGrid, Postmark.