DMARC for SES Email Identities

I understand your frustration with the DMARC issues you're experiencing. The problem you're facing is indeed common when using Amazon SES with email addresses that don't align with the sending domain. Here's an explanation of the issue and some potential solutions:

The DMARC failure occurs because the From address (e.g., GroupA@gmail.com) doesn't align with the domain used by Amazon SES for sending (amazonses.com). This misalignment causes DMARC to fail, which can lead to delivery issues.

There are a few potential solutions to address this:

1. Custom MAIL FROM Domain: Set up a custom MAIL FROM domain in Amazon SES. This allows you to use your own domain for the MAIL FROM address, which can help with SPF alignment for DMARC. You'll need to publish an MX record and an SPF record for this subdomain in your DNS configuration.

2. DKIM Signing: Ensure that you're using DKIM (DomainKeys Identified Mail) signing for your emails. While this won't solve the SPF alignment issue, it can help with DKIM alignment for DMARC. Amazon SES offers Easy DKIM, which can automatically sign your emails.

3. Sender Rewriting: Instead of using the group email addresses directly in the From field, you could use a format like "Group A <noreply@yourdomain.com>" where yourdomain.com is a domain you control and have verified with Amazon SES. This allows you to maintain the group identity while using a domain you can authenticate.

4. Custom Verification Email Templates: If you need to keep the current setup, you might consider using custom verification email templates in SES to explain to recipients why they're receiving emails from an amazonses.com domain.

5. Dedicated IP: If you're sending a high volume of emails, consider using a dedicated IP address with Amazon SES. This gives you more control over your sending reputation.

While setting up your own mail server as suggested by Amazon support is an option, it's not necessarily the easiest or most efficient solution for your use case. The above alternatives, particularly using a custom MAIL FROM domain and implementing DKIM, should help improve your email deliverability without requiring a complete overhaul of your system.

Remember to implement any changes gradually and monitor your email deliverability closely during the transition.
Sources
Setting up a custom MAIL FROM domain - Amazon Simple Email Service
Complying with DMARC Using Amazon SES - Amazon Simple Email Service
Verifying email addresses in Amazon SES - Amazon Simple Email Service
Complying with DMARC authentication protocol in Amazon SES - Amazon Simple Email Service