Defaults.Exposed › Setup walkthroughs › SPF › AWS Route 53

SPF record in AWS Route 53

Route 53 does not add the quotation marks for you. Most DNS (Domain Name System) consoles wrap a TXT (Text) value themselves and tell you to paste the string plain; this one expects you to type the quotes as part of the value. An SPF (Sender Policy Framework) line entered without them is the single most common way this record fails here.

"v=spf1 include:_spf.google.com ~all"

Compare that block against what your mail provider’s own setup page tells you to publish.

What Route 53 is doing

Route 53 is a DNS host inside the AWS Management Console. It stores the record and answers DNS questions for it, publishing exactly the TXT value typed into the Value field once Create records is clicked. The SPF text comes from whichever service sends the domain’s mail; Route 53 does not generate or check it.

Make sure you are in the live hosted zone

A record in Route 53 only does anything if Route 53 is the service answering DNS for the domain. In the console open Hosted zones, select the domain, and read the four NS values shown for that zone. Those four values must match the nameservers set at the domain’s registrar.

If the domain was registered through Route 53 under Registered domains this is usually already lined up, but if it was registered elsewhere, or there is more than one hosted zone for the same domain, the live nameservers may point somewhere else and anything added here does nothing.

Add the record in Route 53

1. Sign in to the AWS console and open Route 53.
2. In the left menu choose Hosted zones, then click the name of your domain.
3. Read the existing records for a TXT entry at the root already starting v=spf1, and edit that one if it is there.
4. Click Create record to start a new entry.
5. If the wizard offers routing-policy options, switch to the simple form by choosing Quick create record.
6. Leave the Record name field empty so the record sits at the domain itself.
7. Set Record type to TXT.
8. In the Value field enter the SPF text wrapped in double quotes, for example "v=spf1 include:_spf.google.com ~all".
9. Leave TTL (Time to Live) at the default of 300 seconds.
10. Click Create records to save the entry.

Leave the Record name field empty, since an empty name means the domain itself and Route 53 shows the domain alongside the field so it does not have to be retyped. Type the SPF text into the Value field inside double quotes, replacing the include: part with the value your own mail provider publishes. Leave TTL at its default of 300 seconds.

Traps on this console

• TXT values must be typed inside double quotes. Some DNS hosts quote the value for you, Route 53 does not, so the entry must read "v=spf1 ..." with the marks present.
• Leaving the Record name field empty is what puts the record at the root. Typing the full domain name into that field makes Route 53 append the zone again, producing yourdomain.com.yourdomain.com, a record nothing ever checks.
• Only one v=spf1 TXT record belongs on a domain. Mailbox providers treat two of them as broken, so if a TXT record starting v=spf1 already exists at the root, edit it to add the new service rather than creating a second one.
• With several hosted zones, or several AWS accounts, it is easy to edit the wrong one. The zone being edited is the one whose NS values match the live nameservers.
• Amazon SES uses a different mechanism by default and SPF for SES is optional. If a custom MAIL FROM domain has been set up in SES, follow the SES instructions for that domain, since SES is a separate service from Route 53 and Route 53 only stores the DNS record.
• A line that needs more than ten DNS lookups to evaluate fails with a permanent error, and each include:, a and mx term spends from that budget.

Softfail or hardfail

-all lets a receiver reject mail from an unlisted server on SPF alone, which can bounce forwarded mail before DKIM (DomainKeys Identified Mail) is checked. ~all marks that mail as a soft fail and leaves the decision to your DMARC (Domain-based Message Authentication, Reporting and Conformance) policy. Both endings are defensible; whichever you choose, list every sender first. In the October 2026 census, 87,173,390 domains (26.2%) end their record on softfail, and 175,426,748 (52.8%) publish no SPF record at all.

SES, MAIL FROM, and why SPF is optional there

A Route 53 zone often belongs to an account that also uses Amazon SES, and SES handles SPF differently, so a generic SPF guide can mislead you in both directions.

By default, SES sends using its own envelope sender domain rather than yours. SPF is checked against that envelope domain, so the check passes on Amazon’s record and your own SPF line is not consulted at all. That is why SES works for a domain with no SPF record, and why adding one changes nothing about SES delivery on its own.

It matters when you configure a custom MAIL FROM domain in SES, usually a subdomain such as mail.yourdomain.com. At that point the envelope sender becomes yours, SPF is checked against the record at that subdomain, and SES tells you to publish an MX (Mail Exchange) and a TXT record there. Those go at the subdomain, not at the root, so they neither replace nor conflict with the root record this page describes.

The reason to configure it at all is DMARC alignment. DMARC passes on SPF only when the envelope domain matches the domain in the From address, and a default SES envelope does not match. A custom MAIL FROM domain makes it match. If SES is your only sender and you have no plans for DMARC enforcement, leaving it on the default is a legitimate choice.

Wait, then check it

DNS changes made in Route 53 are not instant and can take a few minutes up to a couple of hours to spread. The saved record appears back inside the same hosted zone, listed under the domain with its Record type shown as TXT. Reopen the hosted zone and check that the new row shows Record type TXT with an empty name and the quoted value exactly as entered.

With the entry confirmed, run the free scan against your domain, which resolves the record from outside and so tells you whether you edited the zone the domain delegates to.

How the scan grades this record: the SPF record check, with its pass and fail rules and how many domains pass it.

SPF authorises the envelope sender only, and a forged message can still be delivered while SPF fails, until an enforcing DMARC policy says otherwise. The SPF guide covers the evaluation.

Figures from the defaults.exposed census, data as of 12 October 2026. Census numbers move every month; the current values are on the census data page.