How to Migrate from Mandrill to Amazon SES?

Overview

Piano recommends to migrate transactional and notification email sending (for Piano Management + Billing) from Mandrill to Amazon SES. This migration requires you to update your DNS records so that your sending domain is authenticated against Amazon SES, and then enable the SES integration in Piano.

For the full domain verification reference, see Verifying Your Domain for Email Notifications.

Before You Start

Decide What Is Changing

• Same sending domain, same email address: You still need to publish new DNS records for Amazon SES (DKIM CNAMEs, SPF update, and SES TXT verification). Your existing Mandrill-related DNS entries will be replaced.

• Changing to a different domain or subdomain (e.g., from @example.com to @news.example.com): You must publish DNS records for the new domain and follow the additional steps described in the Section here.

Confirm DNS Access

You will need access to your DNS provider (or coordination with the team or vendor who manages your DNS) to add and modify records exactly as provided.

Plan for DNS Propagation

DNS changes can take minutes to 48 hours (and in some cases longer) to fully propagate. Plan your migration timeline accordingly and do not proceed with the switchover until records are verified.

Migration Steps

Obtain the Required DNS Records from Piano

Contact Piano Support at support@piano.io to provide the DNS values you must publish. These typically include:

• Three DKIM CNAME records (for Amazon SES signing)

• One SPF TXT record (or an update to your existing SPF record)

• One TXT verification record (Amazon SES domain verification token)

Publish the DNS Records

3.2.1 DKIM (Required)

Amazon SES DKIM uses three CNAME records. The format is:

<selector1>._domainkey.<your-domain>  CNAME  <selector1>.dkim.amazonses.com
<selector2>._domainkey.<your-domain>  CNAME  <selector2>.dkim.amazonses.com
<selector3>._domainkey.<your-domain>  CNAME  <selector3>.dkim.amazonses.com

Common DKIM mistakes to avoid:

• Adding quotes around the CNAME value.

• Accidentally duplicating the domain (e.g., entering selector._domainkey.example.com.example.com).

• Modifying the SES-generated selector or CNAME values, these must be entered exactly as provided.

SPF (Required)

Publish or update a single SPF TXT record that includes Amazon SES:

v=spf1 include:amazonses.com ~all

If you already have an SPF record (e.g., one that includes Mandrill's servers), do not create a second SPF record. Instead, add include:amazonses.com to your existing record before the final all mechanism.

SPF best practices:

• One SPF record per hostname — multiple SPF TXT records on the same hostname can break validation entirely.

• SPF has a 10 DNS-lookup limit. Too many include: mechanisms can cause SPF failures. If you are near the limit, consider removing the Mandrill include (e.g., include:mandrillapp.com) once the migration is confirmed complete.

TXT Record for SES Domain Verification

Amazon SES requires a TXT record for domain ownership verification:

_amazonses.<your-domain>  TXT  <verification-token>

Use the token value provided by Piano Support for your specific domain and application.

Wait for Propagation and Verify

After the DNS records are published, Piano will typically reflect DKIM, SPF, and TXT verification automatically once the records are resolvable. In some cases this may take a few hours after DNS is correctly published.

Validate DNS Independently (Recommended)

If verification is not completing, verify the records from outside your network using dig or a public DNS checker:

dig <selector>._domainkey.<your-domain> CNAME
dig <your-domain> TXT
dig _amazonses.<your-domain> TXT

If a lookup returns blank or NXDOMAIN, the record is missing or has not yet propagated.

Switch to Amazon SES

Once all DNS records are verified, contact Piano Support to enable the switch from Mandrill to Amazon SES for your application. The Support team will enable Amazon SES sending for your application and confirm the migration is complete.

Changing the Email Sending Domain During Migration

If you need to change your email sending domain as part of this migration (e.g., moving from @example.com to @news.example.com), follow these additional steps:

1. Inform Piano Support of the new sending domain you want to use, along with your Application ID(s).

2. Piano Support will provide the DKIM and TXT verification values for the new domain.

3. Publish the DNS records for the new domain as described in the Section here.

4. Once the records are published, notify Piano Support so they can verify the new domain.

5. After verification, Piano Support will update the sending domain in your application configuration and enable Amazon SES.

Advanced DNS Scenarios

Your Sending Domain Is Configured as a CNAME

If the domain you are trying to authenticate is itself configured as a CNAME in DNS, you cannot publish an SPF TXT record at that same hostname (DNS standards prohibit TXT records at a CNAME label on many providers). In that case:

• Publish SPF on the canonical (target) domain that the CNAME points to.

• Publish DKIM CNAME records as instructed for the sending domain.

Work with your DNS team to confirm your provider's behavior in this scenario.

Deliverability Notes

• If you are switching to a brand-new sending domain (not previously used with Mandrill), it may initially see more filtering until sender reputation is established.

• Keep Mandrill DNS records temporarily until you have confirmed the migration to Amazon SES is complete and email delivery is healthy. Once confirmed, remove legacy Mandrill-related entries (e.g., Mandrill SPF includes and DKIM records) to keep your DNS clean and avoid approaching the SPF lookup limit.

• After the migration, verify that outgoing emails pass authentication by checking message headers for:

  • SPF = pass

  • DKIM = pass

  • DMARC = pass (if configured)

Troubleshooting Checklist

DNS Looks Correct but Piano Still Shows Unverified

• Confirm you published the record on the correct hostname (root domain vs. subdomain).

• Ensure there are no typos, extra spaces, quotes, or duplicated domain suffixes.

• Wait for propagation and re-check using dig or a public DNS checker.

SPF Fails

• You have multiple SPF records on the same hostname — merge them into one.

• You have exceeded SPF's 10 DNS-lookup limit.

• The record is published as the wrong type (it must be a TXT record even if your DNS UI offers a dedicated "SPF" type).

DKIM Fails

• One or more of the three DKIM CNAME records is missing.

• The CNAME target does not resolve to *.dkim.amazonses.com.

• The value includes quotes or was altered from what Piano provided.

Verification Emails Are Not Helping

Domain "verified" status in Piano depends on DNS records (SPF, DKIM, TXT), not only on clicking a link in a verification email. If email-address verification is required as a separate step, open the verification link directly from the mailbox — do not forward it.

What to Send to Piano Support

To speed up the migration process, include the following in your support request:

• The domain(s) you want to send from (current and new, if changing).

• Your Application ID(s).

• Your environment/region (EU, US, AP, AU, Sandbox).

• Whether you are also changing the sending email address or domain as part of this migration.

Last updated: June 26, 2026