Is SPF considered “domain-aligned” by an MTA if you use the “custom MAIL FROM” feature in SES?
i.e., it’s then seen as being sent from a subdomain of your domain rather than http://amazonses.com|amazonses.com, although I would note a reverse DNS lookup on the SES IP would show up as something like <http://XXXXXXX.smtp-out.REGION.amazonses.com|XXXXXXX.smtp-out.REGION.amazonses.com>
You’d want the authorized sending domain(s) in the include tag if you didn’t have static IPS for SES in there. Like if you use Gmail with your domain and that was the only way you wanted to deliver mail, you’d have v=spf1 include:<http://_spf.google.com|_spf.google.com> ~all
https://www.cloudflare.com/learning/dns/dns-records/dns-spf-record/|https://www.cloudflare.com/learning/dns/dns-records/dns-spf-record/
So you likely want to add another include like v=spf1 include:<http://_spf.google.com|_spf.google.com> include:<http://XXXXXXX.smtp-out.REGION.amazonses.com|XXXXXXX.smtp-out.REGION.amazonses.com> -all
