When you set up Easy DKIM for an identity, Amazon SES automatically adds a 1024-bit DKIM key to every email that you send from that identity. You can configure Easy DKIM by using the Amazon SES console, or by using the API.

When you successfully configure Easy DKIM, you can start sending emails from the DKIM enabled domain, even if you haven't completed the procedures in Verifying a domain with Amazon SES.

Easy DKIM consideration

When you use Easy DKIM to authenticate your email, the following rules apply:

• You only need to set up Easy DKIM for the domain that you use in your "From" address. You don't need to set up Easy DKIM for domains that you use in "Return-Path" or "Reply-to" addresses.

• Amazon SES is available in several AWS Regions. If you use more than one AWS Region to send an email, you have to complete the Easy DKIM setup process in each of those regions to ensure that all of your emails are DKIM-signed.

• When you verify a domain, your Easy DKIM settings also apply to all subdomains of that domain, unless you set up Easy DKIM for specific subdomains.

• If you set up Easy DKIM for a parent domain, a subdomain, and an email address, Amazon SES applies Easy DKIM settings in the following ways:

• DKIM settings for a subdomain override the settings for the parent domain.

• DKIM settings for an email address override the settings for the subdomain (if applicable) and the parent domain.

To set up Easy DKIM for a domain

1. Open the Amazon SES console at https://console.aws.amazon.com/ses/.

2. In the navigation pane, under Identity Management, choose Domains.

3. In the list of domains, choose the domain that you want to set up Easy DKIM for.

4. Under DKIM, choose Generate DKIM Settings.

5. Copy the three CNAME records that appear in this section. Alternatively, you can choose Download Record Set as CSV to save a copy of the records to your computer.

6. Add the CNAME records to the DNS configuration for your domain. 

7. Once done, the DKIM Verification Status will change to verified

Amazon SES usually detects changes to your DNS configuration within 72 hours.