Using a custom MAIL FROM domain keeps you within the AWS infrastructure. According to SES documentation:
For an email to comply with DMARC based on SPF, both of the following conditions must be met:
1. The message must pass an SPF check based on having a valid SPF (type TXT) record that you’ve published in your custom MAIL FROM domain’s DNS configuration.
2. The domain in the From address of the email header must align (match) with the domain, or a subdomain of, what’s specified in the MAIL FROM address. To achieve SPF alignment with SES, the domain’s DMARC policy must not specify a strict SPF policy (aspf=s).
Basically, every email contains two ‘from‘ addresses, ‘envelope from‘ and ‘header from.‘ The ‘header from‘ field usually contains the email address displayed to the recipient. The ‘envelope from‘ field, often referred to as the ‘MAIL FROM,‘ specifies to a receiving mail server the source of the message.
If a custom MAIL FROM domain is not set, the ‘envelope from‘ value is <mail_id>@<region>.amazonses.com. In your case, your ‘header from‘ value is <mail_id>@domain.com, and these two do not match.
Without a custom MAIL FROM domain, DMARC can only align with DKIM, but not with SPF, because the ‘envelope from’ and ‘header from‘ values are not the same.
Use a custom MAIL FROM domain to make SPF aligned with DMARC.
References: