Check SES Domains for DKIM, SPF and DMARC

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ListSesIdentities",
      "Effect": "Allow",
      "Action": "ses:ListEmailIdentities",
      "Resource": "*"
    },
    {
      "Sid": "ReadSesIdentities",
      "Effect": "Allow",
      "Action": "ses:GetEmailIdentity",
      "Resource": "arn:aws:ses:*:123456789012:identity/*"
    }
  ]
}

// check-ses-email-authentication.ts
// Reports DKIM, custom MAIL FROM, SPF and DMARC status for every SES domain identity,
// and whether a message from that domain can pass DMARC through aligned DKIM or SPF.
// Report only: it reads SES settings and public DNS, and changes nothing.
// Usage:
//   npx tsx check-ses-email-authentication.ts [--regions us-east-1,eu-west-1]
import dns from "node:dns/promises";
import { GetEmailIdentityCommand, SESv2Client, paginateListEmailIdentities } from "@aws-sdk/client-sesv2";

const args = process.argv.slice(2);
const flag = (name: string): string | undefined => {
  const i = args.indexOf(name);
  return i >= 0 ? args[i + 1] : undefined;
};
const regions = (flag("--regions") ?? process.env.AWS_REGION ?? "us-east-1")
  .split(",")
  .map((s) => s.trim())
  .filter(Boolean);

interface Row {
  Region: string;
  Domain: string;
  DKIM: string;
  MailFrom: string;
  SPF: string;
  DMARC: string;
  Findings: string;
}

// TXT lookup that returns [] when the name or record doesn't exist.
async function txt(name: string): Promise<string[]> {
  try {
    const records = await dns.resolveTxt(name);
    return records.map((chunks) => chunks.join(""));
  } catch (err) {
    const code = (err as NodeJS.ErrnoException).code;
    if (code === "ENODATA" || code === "ENOTFOUND") return [];
    throw err;
  }
}

// Looks for _dmarc on the domain, then on each parent (a simple stand-in for the organizational domain).
async function findDmarc(domain: string): Promise<{ at: string; record: string } | undefined> {
  const labels = domain.split(".");
  for (let i = 0; i <= labels.length - 2; i++) {
    const name = labels.slice(i).join(".");
    const found = (await txt(`_dmarc.${name}`)).filter((r) => /^v=DMARC1\b/i.test(r.trim()));
    if (found.length > 0) return { at: name, record: found[0] };
  }
  return undefined;
}

function dmarcTags(record: string): Map<string, string> {
  const tags = new Map<string, string>();
  for (const part of record.split(";")) {
    const [key, ...rest] = part.split("=");
    if (key && rest.length > 0) tags.set(key.trim().toLowerCase(), rest.join("=").trim().toLowerCase());
  }
  return tags;
}

async function checkDomain(ses: SESv2Client, region: string, domain: string): Promise<Row> {
  const findings: string[] = [];
  const identity = await ses.send(new GetEmailIdentityCommand({ EmailIdentity: domain }));

  // DKIM: Easy DKIM signs with the identity's own domain, so SUCCESS plus signing on means aligned DKIM.
  const dkimStatus = identity.DkimAttributes?.Status ?? "NOT_STARTED";
  const signing = identity.DkimAttributes?.SigningEnabled === true;
  const dkimAligned = signing && dkimStatus === "SUCCESS";
  if (dkimStatus !== "SUCCESS") findings.push(`DKIM ${dkimStatus}`);
  if (!signing) findings.push("DKIM signing turned off");

  // Custom MAIL FROM: without it SES uses a subdomain of amazonses.com, so SPF can't align with your From domain.
  const mailFrom = identity.MailFromAttributes?.MailFromDomain ?? "";
  const mailFromStatus = identity.MailFromAttributes?.MailFromDomainStatus ?? "";
  let spf = "n/a (default MAIL FROM)";
  let spfPossible = false;
  if (!mailFrom) {
    findings.push("no custom MAIL FROM, SPF can't align");
  } else {
    if (mailFromStatus !== "SUCCESS") findings.push(`MAIL FROM ${mailFromStatus || "unknown"}`);
    const spfRecords = (await txt(mailFrom)).filter((r) => /^v=spf1\b/i.test(r.trim()));
    if (spfRecords.length === 0) {
      spf = "missing";
      findings.push(`no SPF record on ${mailFrom}`);
    } else if (spfRecords.length > 1) {
      spf = `${spfRecords.length} records`;
      findings.push("more than one SPF record (SPF permerror)");
    } else if (!/\binclude:amazonses\.com\b/i.test(spfRecords[0])) {
      spf = "no amazonses.com";
      findings.push("SPF record doesn't include amazonses.com");
    } else {
      spf = "ok";
      spfPossible = mailFromStatus === "SUCCESS";
    }
  }

  // DMARC: record on the domain or a parent; a parent's sp= applies to subdomains when present.
  let dmarc = "missing";
  const found = await findDmarc(domain);
  let spfAligned = false;
  if (!found) {
    findings.push("no DMARC record");
  } else {
    const tags = dmarcTags(found.record);
    const policy = (found.at !== domain ? tags.get("sp") : undefined) ?? tags.get("p") ?? "?";
    dmarc = found.at === domain ? `p=${policy}` : `p=${policy} (from ${found.at})`;
    if (policy === "none") findings.push("DMARC monitoring only (p=none)");
    if (!tags.get("rua")) findings.push("no rua= for aggregate reports");
    spfAligned = spfPossible && tags.get("aspf") !== "s";
    if (spfPossible && !spfAligned) findings.push("aspf=s blocks SPF alignment through SES");
  }
  if (!dkimAligned && !spfAligned) findings.push("DMARC fails: no aligned DKIM or SPF");

  return {
    Region: region,
    Domain: domain,
    DKIM: `${dkimStatus}${signing ? "" : " (signing off)"}`,
    MailFrom: mailFrom ? `${mailFrom} ${mailFromStatus}` : "default",
    SPF: spf,
    DMARC: dmarc,
    Findings: findings.join("; ") || "ok",
  };
}

async function main(): Promise<void> {
  const rows: Row[] = [];
  let skippedAddresses = 0;
  for (const region of regions) {
    const ses = new SESv2Client({ region });
    try {
      for await (const page of paginateListEmailIdentities({ client: ses }, {})) {
        for (const id of page.EmailIdentities ?? []) {
          if (id.IdentityType !== "DOMAIN" || !id.IdentityName) {
            skippedAddresses++;
            continue;
          }
          rows.push(await checkDomain(ses, region, id.IdentityName));
        }
      }
    } catch (err) {
      console.error(`${region}: ${err instanceof Error ? `${err.name}: ${err.message}` : String(err)}`);
    }
  }
  console.log(`SES domain identities checked: ${rows.length} (email address identities skipped: ${skippedAddresses})`);
  if (rows.length > 0) console.table(rows);
  console.log("Report only. Nothing was changed in SES or DNS.");
}

main().catch((err) => {
  console.error(err);
  process.exit(1);
});

npm install @aws-sdk/client-sesv2
npm install --save-dev tsx typescript @types/node

# Check every SES domain identity in two Regions
AWS_PROFILE=readonly npx tsx check-ses-email-authentication.ts --regions us-east-1,eu-west-1

SES domain identities checked: 2 (email address identities skipped: 1)
┌─────────┬─────────────┬────────────────────┬───────────┬──────────────────────────────┬───────────────────────────┬─────────────────────────────┬──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
│ (index) │ Region      │ Domain             │ DKIM      │ MailFrom                     │ SPF                       │ DMARC                       │ Findings                                                                                                                                                 │
├─────────┼─────────────┼────────────────────┼───────────┼──────────────────────────────┼───────────────────────────┼─────────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ 0       │ 'us-east-1' │ 'example.com'      │ 'SUCCESS' │ 'bounce.example.com SUCCESS' │ 'ok'                      │ 'p=quarantine'              │ 'ok'                                                                                                                                                     │
│ 1       │ 'us-east-1' │ 'mail.example.org' │ 'PENDING' │ 'default'                    │ 'n/a (default MAIL FROM)' │ 'p=none (from example.org)' │ "DKIM PENDING; no custom MAIL FROM, SPF can't align; DMARC monitoring only (p=none); no rua= for aggregate reports; DMARC fails: no aligned DKIM or SPF" │
└─────────┴─────────────┴────────────────────┴───────────┴──────────────────────────────┴───────────────────────────┴─────────────────────────────┴──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘
Report only. Nothing was changed in SES or DNS.