In this article, you will learn how AirLST secures your emails with SPF, DKIM and DMARC, which DNS records you need to set up, and what you can do to ensure reliable delivery of your invitations, confirmations and tickets.
You can find out how to set up a custom sender domain here: Custom email sender
SENDING INFRASTRUCTURE
All emails from the AirLST Suite are delivered via Amazon Simple Email Service (Amazon SES). Amazon SES maintains direct relationships with major mailbox providers, including feedback loops through which spam complaints are automatically reported back to the sender.
AirLST uses this infrastructure exclusively for event communications: invitations, registration and booking confirmations, tickets, reminders and information related to an event.
SPF, DKIM AND DMARC AT A GLANCE
For every incoming email, mailbox providers check whether the sender is authorised to send on behalf of the specified domain. There are three standards for this, which build on one another:
| Standard | What it checks | Implementation at AirLST |
|---|---|---|
| SPF | Is the sending server authorised to send for the domain in the Envelope Sender (Return-Path)? | SPF record on your MAIL-FROM subdomain authorising Amazon SES |
| DKIM | Is the email cryptographically signed and has it remained unchanged in transit? | Signature with your domain using three DKIM keys, which are stored in your DNS via CNAME records |
| DMARC | Does the domain verified through SPF or DKIM match the visible sender address (alignment)? | Your DMARC policy applies because both SPF and DKIM are aligned with your domain |
WHAT IS SPF?
SPF (Sender Policy Framework) specifies which mail servers are authorised to send emails on behalf of your domain.
1. The SPF record is stored as a TXT record in your domain’s DNS settings.
2. When an email is received, the recipient’s mail server checks whether the sending server is listed in this SPF record.
3. If the server is not authorised, the email may be marked as spam or rejected.
| Note: An SPF record for AWS SES does not mean that all AWS servers are allowed to send emails on your behalf. Only our explicitly authorised AWS account is approved. However, SPF alone is not sufficient to verify that an email is genuine. |
WHAT IS DKIM?
DKIM (DomainKeys Identified Mail) is a digital signature for emails. It is generated using a private key and can only be added by servers that possess this key—in our case, our AWS account.
1. The public key is stored as a DNS record.
2. The receiving mail server checks whether the signature matches the public key.
3. Only correctly signed emails are considered authentic.
4. Emails without a valid DKIM signature may be identified as forged.
With a custom sender domain, you send from an address such as invitation@your-domain.com. After the three CNAME records have been stored, every email is provided with a DKIM signature from your own domain. The signature therefore belongs to the same domain as the visible sender. This is exactly what Microsoft 365, Gmail, GMX, WEB.DE and T-Online evaluate during the DMARC check.
WHAT IS DMARC?
DMARC (Domain-based Message Authentication, Reporting and Conformance) builds on SPF and DKIM. It tells mail servers how to handle emails that do not pass these checks.
• You specify whether unauthenticated emails should be rejected or moved to quarantine.
• You receive reports about unauthorised sending attempts.
• Attackers are significantly hindered from sending forged emails on behalf of your domain.
CUSTOM MAIL FROM (ENVELOPE SENDER)
In addition to the visible sender address, every email has a technical sender known as the Envelope Sender or Return-Path. Bounces are sent to this address, and the SPF check is based on this domain.
Without custom configuration, this is a domain belonging to Amazon SES. SPF is then valid, but it is not aligned with your domain. AirLST therefore sets up a custom Envelope Sender upon request, usually as the subdomain airlst-mail.your-domain.com. This aligns both SPF and DKIM with your domain, providing two layers of DMARC protection.
| Tip: Contact our Customer Service Team to set up Custom MAIL FROM if needed. |
EXAMPLE DNS RECORDS
You will receive the exact values during onboarding with AirLST. The table shows the structure:
| Type | Name | Value |
|---|---|---|
| CNAME (3 records) | <token>._domainkey.your-domain.com | <token>.dkim.amazonses.com |
| MX | airlst-mail.your-domain.com | 10 feedback-smtp.<region>.amazonses.com |
| TXT | airlst-mail.your-domain.com | v=spf1 include:amazonses.com ~all |
| TXT | _dmarc.your-domain.com | v=DMARC1; p=none; rua=mailto:dmarc@your-domain.com |
| Tip: Start DMARC with p=none and an address for reports (rua). This allows you to see which systems are sending on your behalf. Once all sources have been properly authenticated, you can switch to p=quarantine or p=reject. |
ADDITIONAL SECURITY MEASURES FROM AIRLST & AWS
OPT-IN CONFIRMATION FOR SENDER ADDRESSES
• Before an email address can be used as a sender, the owner of the address must explicitly confirm this.
• The address receives an email with a confirmation link, which must be clicked within 24 hours.
• The address can only be used as a sender for the respective AirLST account after confirmation.
• The right to use the address remains exclusive to the AirLST account that requested approval.
DOMAIN VERIFICATION
Before AWS SES can be used for a domain, the owner must verify the domain. Use is then reserved exclusively for the AirLST AWS account and cannot be used by other AWS customers.
DEDICATED IP POOL
For Professional and Enterprise customers, AirLST operates a dedicated IP pool. These IPs are not shared with arbitrary other senders on Amazon SES, but are used exclusively by a selected group of approved AirLST customers.
| Note: The IPs are deliberately not permanently assigned to a single customer. Event sending occurs in peaks: high volume before an event, followed by low volume for weeks. A single IP with such irregular volume can hardly build a reputation. The shared volume in the pool keeps sending consistent and the reputation stable. |
SENDING LIMITS & MONITORING
Amazon SES continuously monitors bounce and complaint rates and limits sending speed through defined sending quotas. As a result, large mailings are delivered at a controlled speed, so that the acceptance limits of recipient providers are not triggered.
BOUNCES, COMPLAINTS AND SUPPRESSION LIST
| Event | Handling |
|---|---|
| Hard bounce (address does not exist) | The address is automatically added to a suppression list. No further emails are delivered to this address. |
| Soft bounce (e.g. mailbox full) | Delivery is automatically retried for a limited period. |
| Spam complaint | Complaints reported through providers’ feedback loops also result in the address being blocked. |
| Incorrect block | If an address was blocked incorrectly, for example after a temporary server problem at the recipient’s end, AirLST can review it and remove the block. |
LINK AND OPEN TRACKING
Link and open tracking is disabled by default in AirLST. The links in your emails remain exactly as you inserted them, and no tracking pixel is added.
Rewritten links whose domain does not match the sender, as well as invisible pixels, are a negative signal for many spam filters. You can see directly from the registrations in AirLST whether an invitation has been effective.
| Note: Tracking can be enabled optionally. The links then run through a standard Amazon SES domain, not through a separate domain for each customer. For invitations and confirmations, we recommend leaving tracking disabled. |
NOTES ON INDIVIDUAL PROVIDERS
| Provider | What you should be aware of |
|---|---|
| Microsoft 365 / Exchange Online | In addition to Microsoft’s filters, the configuration of the respective organisation is decisive. Strict quarantine rules or Microsoft Defender may also hold back correctly authenticated emails. Have the sender domain approved in advance by the IT department of important corporate customers. |
| Outlook.com / Hotmail | Since 2025, senders with high volumes have been subject to specific requirements for SPF, DKIM and DMARC. The setup described here meets them. |
| GMX / WEB.DE | They place strong emphasis on authentication and reputation. Avoid changing sender addresses or domains for the same event. |
| T-Online | Only accepts emails if an imprint is accessible under the sender domain, e.g. your-domain.com/imprint. New senders can also contact the T-Online postmaster. |
| Gmail / Yahoo | Have required SPF, DKIM, DMARC and a low complaint rate since 2024. The setup described here meets these requirements. |
| Important: Check the imprint before sending for the first time, especially if you are using a custom event domain. Without an accessible imprint, T-Online will reject your emails. |
DIVISION OF RESPONSIBILITIES
Deliverability is a shared responsibility. AirLST provides the infrastructure, while some decisive factors are your responsibility as the sender.
| AirLST | You as the sender |
|---|---|
| Sending infrastructure on Amazon SES | Set DNS records for DKIM, MAIL FROM and DMARC |
| Set up of sender domain, DKIM and Custom MAIL FROM | Accessible imprint on the sender domain |
| Dedicated IP pool (Professional and Enterprise) | Up-to-date, clean recipient lists without purchased addresses |
| Automatic handling of bounces and complaints | Consistent sender address and clear subject line |
| Controlled sending speed, tracking disabled by default | Approval of the sender domain by important corporate customers |
CONCLUSION
SPF alone is not sufficient protection against domain abuse. Only the combination of SPF, DKIM, DMARC, Custom MAIL FROM and the additional AirLST security measures ensures that only authorised systems send emails on behalf of your domain and that your event emails reliably reach the inbox.
If you have any questions, our Customer Service Team is always available to assist you.