Verify your sending domain (DKIM, SPF, DMARC)

Mailbox providers trust mail that is authenticated. Three standards matter.

DKIM (required)

DKIM signs every message with a key published in your DNS. When you add a domain, CARIO Mail shows three CNAME records like abc._domainkey.mail.yourbrand.com. Add all three exactly as shown. Use Check DNS now to see which records are already visible, then Check with AWS to finish verification.

SPF

Amazon SES handles SPF on its own bounce domain, so you do not need to change SPF for DKIM-based sending. If you set up a custom MAIL FROM domain later, add the SPF record shown for it.

DMARC (strongly recommended)

DMARC tells receivers what to do with mail that fails checks. Gmail and Yahoo require it for bulk senders. Start in monitor mode:

_dmarc.yourbrand.com  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@yourbrand.com"

After a few weeks of clean reports, move to p=quarantine and later p=reject.

Tips

• Use a subdomain (mail. or news.) so marketing reputation does not affect your main domain.
• Some DNS providers add your domain automatically: enter only abc._domainkey.mail as the name if the full name gets doubled.
• DNS changes can take up to 48 hours, but most finish within minutes.