SES EmailIdentity DKIM records include region, unlike console

[NielsVanWoensel]

Hey folks,

I'm trying to verify my email domain in Amazon SES using EmailIdentity construct in TypeScript:

    const identity = new EmailIdentity(this, "DomainIdentity", {
      dkimIdentity: DkimIdentity.easyDkim(EasyDkimSigningKeyLength.RSA_2048_BIT),
      identity: Identity.domain("my-domain.com"),
      dkimSigning: true,
      feedbackForwarding: true,
    });

The identity exposes dkimRecords, which I output like this:

    new CfnOutput(this, "DkimRecord0Name", {
      value: identity.dkimRecords[0].name,
    });
    new CfnOutput(this, "DkimRecord0Value", {
      value: identity.dkimRecords[0].value,
    });

The generated CNAMEs contain the region (eu-central-1 in my case).
However, when I check the SES console under:
SES -> Configuration -> Identities > my-domain.com > Authentication > DKIM, the CNAMEs shown there are almost the same but do not include the region.

Is this the expected behavior when creating EmailIdentity via CDK, or am I missing a configuration detail?

Thanks in advanced!

[DYNOSuprovo]

Hi @NielsVanWoensel!

Short answer: Yes, this is completely expected behavior, and the regional CNAME values will verify your domain seamlessly in Amazon SES.

Here is the exact reason for the difference and why both are fully supported:

---

Why CDK Includes the Region

In Amazon SES Easy DKIM, AWS provides two equally valid DNS target formats for DKIM CNAME records:

1. Global format (used by default in the AWS Console):

   <token>.dkim.amazonses.com
   

2. Regional format (used by AWS CDK & CloudFormation):

   <token>.dkim.<region>.amazonses.com
   # (e.g., <token>.dkim.eu-central-1.amazonses.com)
   

In AWS CDK's @aws-cdk/aws-ses construct library, EmailIdentity explicitly incorporates the stack's region (${token}.dkim.${region}.amazonses.com) to:

• Ensure deterministic, region-aware DNS routing across all global AWS regions and partitions.
• Prevent cross-region dependency edge cases in newly launched or isolated AWS regions where global endpoint propagation might experience delay.

---

How AWS DNS Handles Both

On Amazon's authoritative DNS name servers, both domains resolve to the exact same SES public key infrastructure:

<token>.dkim.eu-central-1.amazonses.com  ──┐
                                          ├──> [Amazon SES DKIM Key Servers]
<token>.dkim.amazonses.com              ──┘

When you publish the regional records (identity.dkimRecords[x].value) in your DNS provider (Route 53, Cloudflare, Namecheap, etc.):

1. Amazon SES periodically queries your domain's DNS for <token>._domainkey.my-domain.com.
2. It resolves the CNAME target <token>.dkim.eu-central-1.amazonses.com and retrieves the public key.
3. In the SES Console, your domain status will flip from Pending to Success / Verified without any issues.

You do not need to strip or modify the region string. You can use the values output by CDK directly.

---

If this clarifies the regional CNAME format for you, please feel free to mark this as the accepted answer!