Transactional Email

Email Authentication: SPF, DKIM, DMARC

SPF — Who Can Send

# DNS TXT record for yourapp.com:
"v=spf1 include:amazonses.com ~all"
# Says: only Amazon SES may send from @yourapp.com

DKIM — Cryptographic Signature

Signs every email. Receiving servers verify with your public key in DNS. Proves email wasn't tampered with in transit. AWS SES generates keys and provides CNAME records to add to DNS.

DMARC — Policy Enforcement

# DNS TXT record for _dmarc.yourapp.com:
"v=DMARC1; p=quarantine; rua=mailto:dmarc@yourapp.com"
# p=none       → monitor only (start here)
# p=quarantine → failed emails go to spam
# p=reject     → failed emails are rejected (goal)

Sending with AWS SES (Node.js)

npm install @aws-sdk/client-ses

import { SESClient, SendEmailCommand } from "@aws-sdk/client-ses";
const ses = new SESClient({ region: "us-east-1" });

async function sendWelcomeEmail(to, name) {
  await ses.send(new SendEmailCommand({
    Source: "hello@yourapp.com",     // Must be verified in SES
    Destination: { ToAddresses: [to] },
    Message: {
      Subject: { Data: "Welcome to YourApp!" },
      Body: {
        Html: { Data: "<h1>Welcome!</h1>" },
        Text: { Data: "Welcome!" }
      }
    }
  }));
}

Email Service Comparison