AWS SES requirements on custom MAIL FROM domain

user2959071 asked:

According to the docs, AWS SES has some requirements on what is an allowable MAIL FROM domain:

The subdomain you use for your MAIL FROM domain has to meet the following requirements:

The MAIL FROM domain has to be a subdomain of the verified identity (email address or domain) that you send email from. For example, mail.example.com is a valid MAIL FROM domain for the domain example.com.

The MAIL FROM domain shouldn’t be a domain that you send email from. If you have to use the MAIL FROM domain in a From address, either disable email feedback forwarding and receive your bounces through Amazon SNS notifications, or ensure that your MAIL FROM domain is not the destination for feedback forwarding. To determine the destination of email forwarding feedback, see Email feedback forwarding destination.

The MAIL FROM domain shouldn’t be a domain that you use to receive email.

What is the reason for these requirements? Is this a general rule for all email services or just an AWS SES thing? In particular, I currently have my DNS SPF/DKIM/DMARC records set up so that I can send from both AWS SES and Google Workspace (formerly G Suite). For example, my current outbound emails from Google Workspace would have a "MAIL FROM" header of [email protected] which is the identical value for the "From" header. Does this cause problems?

My answer:


This is a normal setup for both transactional and marketing email, and other providers who handle such email will also have similar requirements. The point is primarily to isolate email reputation for this stream of mail from that of your domain. People will mark your email as spam despite having knowingly signed up to receive it, and you really do not want this to affect email for your domain name.


View the full question and any other answers on Server Fault.

Creative Commons License
This work is licensed under a Creative Commons Attribution-ShareAlike 3.0 Unported License.