Verify a domain identity in Amazon SES

Agencies almost always send from the client’s domain (news@client.com), not @gmail.com. SES must own that domain identity (or at least a verified address) before production sends succeed.

Prefer domain over single email

Approach	Best when	Limitation
Domain identity	Ongoing newsletters / automations	Needs DNS (DKIM)
Email identity	Quick test to one inbox	Only that address; SES sandbox still applies

Steps in AWS

1. Open Amazon SES → Identities → Create identity.
2. Choose Domain, enter client.com (no www unless that is the mail brand).
3. Enable Easy DKIM (RSA 2048).
4. Copy the CNAME records SES shows.
5. Publish them at the DNS host (Cloudflare, Route 53, GoDaddy, etc.).
6. Wait until SES shows Verified (often 15–60 minutes; can be longer with slow DNS).

Tip: Use a subdomain like mail.client.com if the apex DNS host is locked by IT — then From addresses become hello@mail.client.com.

Then in EonMailer

1. Deliverability → add the same domain for the client workspace.
2. Confirm DKIM / SPF checks turn green (see Verify a domain in EonMailer).
3. Create a sender profile using an address on that domain.
4. Run a test send to a mailbox you control.

Common failures

• Pending forever — CNAMEs mistyped, or Cloudflare proxy (orange cloud) enabled on DKIM CNAMEs. Set DNS-only (grey cloud).
• Verified in SES, red in EonMailer — wrong AWS region on the connection, or a different AWS account than the one you verified.
• Can only mail yourself — still in SES sandbox.

Next

• Connect Amazon SES to EonMailer
• SPF, DKIM, and DMARC explained