Amazon SES - DMARC Record

Are you using a custom MAIL FROM domain? e.g. subdomain.31west.net.

If yes, you need to create DNS record for the custom domain, not parent domain (31west.net), i.e.

subdomain.31west.net  MX 10 feedback-smtp.region.amazonses.com
subdomain.31west.net TXT "v=spf1 include:amazonses.com ~all"

and NOT

31west.net  MX 10 feedback-smtp.region.amazonses.com
31west.net TXT "v=spf1 include:amazonses.com ~all"

Refer to your SES console for the exact DNS entry to create. More info at Using a custom MAIL FROM domain

Also ensure that DMARC records are correct as per Complying with DMARC authentication protocol in Amazon SES. Take note of alignment settings, e.g. aspf=r

IMPORTANT! Go to your SES console, Identities for exact DNS entries to use

Below is an example. The exact DNS values to configured are in your AWS SES console.

Looking at your DNS records. This is incorrect

% dig +short TXT 31west.net
"v=spf1 include:amazonses.com ~all"
"google-site-verification=chsclT2_I7ZbxQYO2sMay_jLF48PgpB2Zv4wQX_EaL4"
"v=spf1 +a +mx +ip4:68.66.216.9 +ip4:204.93.193.227 +include:relay.mailchannels.net +ip6:2600:3c01::f03c:91ff:fe73:8e5b +include:amazonses.com ~all"

You have 2 SPF entries. Remove the first entry i.e. "v=spf1 include:amazonses.com ~all"

Thanks @MikeLim

I don't want to use custom MAIL FROM domain, so I will go with.

31west.net  MX 10 feedback-smtp.region.amazonses.com
31west.net TXT "v=spf1 include:amazonses.com ~all"

Where do I setup the below settings?

alignment settings, e.g. aspf=r

Thanks

The issue you're experiencing with Amazon SES console showing "MAIL FROM record is not aligned" despite having a correct DMARC record is likely related to the alignment between your "From" address domain and the MAIL FROM domain used by Amazon SES.

To resolve this issue, you have a couple of options:

1. Set up a custom MAIL FROM domain: This is often the most effective solution. By configuring a custom MAIL FROM domain in Amazon SES, you can ensure that the MAIL FROM domain aligns with your "From" address domain. This involves adding specific DNS records (MX and TXT) for your custom MAIL FROM domain.

2. Adjust your DMARC policy alignment: If you haven't already, you can try changing your SPF alignment in the DMARC record from strict to relaxed. This allows the MAIL FROM domain to be a subdomain of the domain in the "From" header. To do this, ensure your DMARC record includes "aspf=r" (for relaxed alignment) instead of "aspf=s" (for strict alignment).

3. Double-check your SPF record: Ensure that your SPF record includes Amazon SES as an authorized sender for your domain. It should contain "include:amazonses.com" in the record.

If you've already implemented these steps and are still seeing the issue, it's possible there might be a delay in DNS propagation. Sometimes it can take up to 48 hours for changes to fully propagate across all DNS servers.

If the problem persists after trying these solutions and waiting for DNS propagation, you may need to contact AWS support for further assistance, as there could be a specific issue with your SES configuration that requires closer examination.
Sources
Complying with DMARC Using Amazon SES - Amazon Simple Email Service
Complying with DMARC authentication protocol in Amazon SES - Amazon Simple Email Service
DMARC record problem - MAIL FROM record is not aligned | AWS re:Post
How do I solve the 'MAIL FROM record is not aligned' recommendation in Virtual Delivery Manager? | AWS re:Post
Amazon SES: Email Authentication and Getting Value out of Your DMARC Policy | AWS Messaging & Targeting Blog