1

I have OpenDKIM properly set up to sign emails from my domain such that when sent through Amazon SES, Yahoo Mail shows dkim=pass. Given I got the infrastructure working, is there any benefit to having Amazon's DKIM signature instead of my own, say for spam filtering purposes?

2
  • 1
    I'm not totally sure on how Amazon do the DKIM for SES but I would imagine you probably share the same DKIM domain as some other senders. Some receiving domains build reputation based on the DKIM domain, so you may be affected by the negative actions of other senders. With your own domain you won't have this potential issue. Whether Amazon have a special relationship with big receivers to whitelist their DKIM domain or anything like that, I highly doubt it.
    – Blates
    Nov 26, 2013 at 14:59
  • This may be a bad question, as the Amazon DKIM signature is signing the message on behalf of the domain of the original message. So my server signs it for example.com and then Amazon signs it also for example.com, but because I added CNAMES for Amazon's DKIM entries, they look like they are mine. So the question is, is the Amazon key pair that signs the message also signed and recognized by spam systems. Nov 26, 2013 at 22:26

1 Answer 1

1

If Amazon does it for free (Well, not free, but included with their per-message billing), Why should you spend resources in signing your emails?. Think of it as a matter of costs:

  • SES DKIM signed email = 1 x SES Message

  • Self calculated DKIM signed email = 1 x SES message + DKIM signature CPU

It may sound insignificant, but think of tens of thousands of emails per month. That's a lot of CPU spent in something that SES is already doing by itself.

If CPU spends are not a problem, double signing your emails should not be an issue at all.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .