MailKite DNS on Amazon Route 53

Amazon Route 53 supports all four DNS records MailKite requires — one MX and three TXT records (SPF, DKIM, DMARC) — created in your hosted zone via the console or one AWS CLI change batch. Two Route 53 conventions to know: the MX value embeds the priority (10 mx.mailkite.dev), and TXT values are wrapped in double quotes.

Before you start

• Add your domain in MailKite to get the exact record values — the DKIM key is unique per domain.
• Confirm the domain's nameservers point at the hosted zone's four awsdns-* servers (they will, if the domain is registered via Route 53 or you've delegated to it).

The records, Route 53-style

In the console, Record name takes the prefix (leave it empty for the zone apex). Values below are for myapp.ai:

For a subdomain like mail.myapp.ai in the myapp.ai zone, the Record names become mail, mail, mailkite._domainkey.mail, and _dmarc.mail.

Console steps

1. Open the Route 53 console → Hosted zones and select your zone.
2. Click Create record.
3. Add each of the four records above. For MX, type the value as 10 mx.mailkite.dev — priority and host in one string.
4. Save. Route 53 serves changes within seconds (status INSYNC).

Or one CLI change batch

aws route53 change-resource-record-sets \
  --hosted-zone-id Z0123456789ABC \
  --change-batch '{
  "Changes": [
    { "Action": "UPSERT", "ResourceRecordSet": {
      "Name": "myapp.ai", "Type": "MX", "TTL": 3600,
      "ResourceRecords": [{ "Value": "10 mx.mailkite.dev" }] } },
    { "Action": "UPSERT", "ResourceRecordSet": {
      "Name": "myapp.ai", "Type": "TXT", "TTL": 3600,
      "ResourceRecords": [{ "Value": "\"v=spf1 include:mailkite.dev ~all\"" }] } },
    { "Action": "UPSERT", "ResourceRecordSet": {
      "Name": "mailkite._domainkey.myapp.ai", "Type": "TXT", "TTL": 3600,
      "ResourceRecords": [{ "Value": "\"v=DKIM1; k=rsa; p=YOUR_KEY\"" }] } },
    { "Action": "UPSERT", "ResourceRecordSet": {
      "Name": "_dmarc.myapp.ai", "Type": "TXT", "TTL": 3600,
      "ResourceRecords": [{ "Value": "\"v=DMARC1; p=none;\"" }] } }
  ]
}'

UPSERT creates or overwrites each record set. Find your zone ID with aws route53 list-hosted-zones-by-name.

Verify

npx @mailkite/cli domains verify <domainId> --json

Route 53 answers with the new records in under a minute; global resolver caches may take a bit longer. The domain flips to verified once MX resolves.

Route 53 gotchas

• One record set per name + type. If the apex already has a TXT record set (site verifications, an existing SPF), you can't create a second one — edit the existing set and add your value as an additional line.
• One SPF record per name. Even as separate lines in one record set, keep a single v=spf1 string — merge include:mailkite.dev into it.
• Quote TXT values. The CLI/API require literal double quotes around each TXT string (escaped in JSON, as above). The console adds them if you forget, but check the saved value.
• Sending via Amazon SES too? SPF allows multiple includes: v=spf1 include:mailkite.dev include:amazonses.com ~all.

FAQ

Does Route 53 allow the DNS records MailKite requires?

Yes. MX and TXT are first-class Route 53 record types with no restrictions. The only differences from other providers are notational: priority inside the MX value and quoted TXT strings.

Can I automate this with Terraform or CloudFormation?

Yes — they're ordinary aws_route53_record / AWS::Route53::RecordSet resources. Use the same four name/type/value tuples as the CLI batch above.

Do I need Route 53 as my registrar?

No. Route 53 only needs to host the zone — the domain can be registered anywhere as long as its nameservers delegate to your hosted zone.

Next: receive your first message, or see the full Domains & DNS reference.