Amazon SES and Gsuite

[ndedge]

hey

if we are already using gsuite we need to add a subdomain for amazon SES but where will this subdomain point to ?

thx

sayantan

[ndedge · Accepted solution]

TLT 1800 

https://docs.aws.amazon.com/ses/latest/DeveloperGuide/dns-txt-records.html 

Spoiler

Important

Some DNS providers, such as GoDaddy, automatically append the domain name to the end of DNS records. Adding a record that already contains the domain name (such as _amazonses.example.com) might result in the duplication of the domain name (such as _amazonses.example.com.example.com). To avoid duplication of the domain name, add a period to the end of the domain name in the DNS record, or just omit your domain from the record name. See the documentation provided by your DNS provider for more information.

[PL281]

@ndedge 

I use both Google Suite and Amazon SES - I'm a little confused by your question. Can you explain what your setup is and how you are looking to use SES

I use it with WordPress and it is authenticated to only send from my domain and I added a TXT record for @ with the value from SES

[ndedge]

hi

i added TXT MX DMARC DKIM into godaddy panel for SES keeping gsuit record unchanges  . i really did not able to figure out where we should point a subdomain ? . https://stackoverflow.com/questions/48021509/use-amazon-ses-and-google-gsuite-for-the-same-domain 

[PL281]

@ndedge 

1) What is your domain?

2) Again I ask what are you trying to accomplish? I have about 30 SES accounts for various clients and I've never adjusted the MX records - I'm trying to understand what you want to do. I know that Amazon lists multiple records on the configuration screen, but they are not all required unless you have a specific setup you are trying to accomplish.

[ndedge]

my domain is ndedges.com 

i will use SES for mailserver and for email campaign.  

[PL281]

@ndedge 

You cannot have MX records pointed to 2 different providers

Inbound SES is for when you want / need to use Amazon WorkMail and the mail is actually stored on Amazon S3

You would not use this for Google Suite. 

I believe what you want is to remove the SES MX record and just leave the Google Suite MX records.

Then in your eblast program (I use Mailster for WordPress) I am able to use the SES API Plugin and then route the outbound / blast email out via SES

[ndedge]

let me try it out once. 

[ndedge]

Waiting for amazon ses to verify. It takes reallly long. I tired digwebinternal.com to get a dig results it shows all the txt but not dkim. What do we need to do for dkim? Dkim can manually be verified but I need to know the steps.

Thx
Sayantan

[PL281]

@ndedge 

I just did a dig for _amazonses.ndedges.com for a TXT Record and there was none - the DKIM and the MX record are optional records - the _amazonses.ndedges.com is really the only required DNS entry

[ndedge]

ndedges.com.		604800	IN	TXT	"amazoneses:<some_random_num>

it shows me like the above 

[PL281]

@ndedge 

So in the DNS manager you want to add a TXT record 

The Host is _amazonses and the value is the string from Amazon, the TTL should be custom 600

The 2 columns displayed in Amazon are 2 different elements not meant to be merged together

[ndedge]

Hey

amazon provides both option to avoid "_" they are not meant to be merged here but it was an intention to use it as alternate option . however i made the TLT = 600 seconds . IF you download the CSV you would able to find the alternate option for the entry. let me know 

Spoiler

The 2 columns displayed in Amazon are 2 different elements not meant to be merged together

[PL281]

@ndedge 

Interesting - if you go into the instructions page there is a 2nd Note

Amazon SES previously allowed TXT record names to contain amazonses without an underscore. If you have already verified a domain and your TXT record contains amazonses without an underscore, your domain will continue to be verified; there is no action required on your part. However, any new domains that you verify will require that amazonses in the TXT record name is either preceded by an underscore, or _amazonses is removed from the TXT record name entirely.

[ndedge · Accepted solution]

TLT 1800 

https://docs.aws.amazon.com/ses/latest/DeveloperGuide/dns-txt-records.html 

Spoiler

Important

Some DNS providers, such as GoDaddy, automatically append the domain name to the end of DNS records. Adding a record that already contains the domain name (such as _amazonses.example.com) might result in the duplication of the domain name (such as _amazonses.example.com.example.com). To avoid duplication of the domain name, add a period to the end of the domain name in the DNS record, or just omit your domain from the record name. See the documentation provided by your DNS provider for more information.

[Nate · Accepted solution]

Should be like this...

Host	Value
_amazonses	[unique code from Amazon]

[ndedge]

hey Nate

interesting part is : it must be in same format for DKIM too. now i have verified in amazon for TXT and dkim. now plz suggest me about DMARC . 

thx

sayantan 

[Nate]

Host	Value
_dmarc	[your settings]

For the first box 'whatever' = whatever.yourdomain.com or if you need a record on the bare domain use @ instead.

[ndedge]

thx Nate i need to check DMARC setup as described here 

https://docs.aws.amazon.com/ses/latest/DeveloperGuide/send-email-authentication-dmarc.html

TLT = 1800 ?

and what about the mx record provided by AWS ? do i need another subdomain ? 

thx

sayantan 

[Nate]

The TTL usually doesn't really matter, we can check with @PL281 if there's a reason this should be something in particular in this instance.

[PL281]

@ndedge 

1) I see you've verified with the TXT record.

2) As previously mentioned you really don't need to the MX record as you are using Google Suite.

Amazon SES is typically used for outbound email for eblast systems. It is used for incoming when you are hosting email on one of Amazon's Hosting Options. You are hosting your email on Google so that isn't needed. 

Amazon doesn't know what your set up is / how you are going to use the platform so they provide all the records that could be needed not that they should all be used.

[ndedge]

@PL281  and @Nate 

correct me if i am wrong: 

so if we want to migrate from Gsuite to some opensource email on ec2 aws compute we need to add the MX record for aws too? 

thx

sayantan