Get started
Sending domains
Authenticate your sender with DKIM, custom MAIL FROM and a clear DNS verification workflow.
Add a domain
Add a domain you control in the project's Domains screen. Enter a DNS name without a protocol, path or email address. RavenRelay provisions the SES identity in the backend's configured AWS region and displays its DNS records.
Publish the DNS records
| Purpose | Type | Host / value |
|---|---|---|
DKIM | 3 × CNAME | <token>._domainkey.example.com → <token>.dkim.amazonses.com |
MAIL FROM | MX | raven.example.com → feedback-smtp.<region>.amazonses.com (priority 10) |
SPF | TXT | raven.example.com → v=spf1 include:amazonses.com ~all |
DNS providers may append your domain automatically. If yours does, enter only the relative host. Disable proxying for DKIM CNAMEs. Their Amazon targets are required by SES and should not be replaced with a branded hostname.
MAIL FROM always uses raven.<sending-domain>. This keeps it separate from your normal mailbox host. Use the SES region displayed in the dashboard.
Understand DMARC
RavenRelay checks TXT records at _dmarc.<sending-domain>. Missing means a DMARC record was not detected at that name. On a subdomain, the current checker does not evaluate inherited organizational-domain policies.
Type: TXTHost: _dmarc.example.comValue: v=DMARC1; p=none;Review any existing policy before changing it. DMARC detection is separate from identity, DKIM and MAIL FROM readiness; a missing DMARC record does not itself block sending.
Verification troubleshooting
- Check the full host name for an accidentally duplicated domain suffix.
- Allow DNS propagation, then refresh verification.
- Confirm DKIM CNAMEs are DNS-only and MX priority is 10.
- If SES setup failed, retry verification after the operator checks backend credentials, region and IAM permissions.
An existing SES identity is not a reason to delete a working provider identity. An operator should inspect provisioning errors before changing resources.