Your daily digest emails are sent from bounces.woot.com, yet you have no SPF record for that subdomain. You do have it setup correctly for woot.com, but that doesn’t get applied to your subdomains. Just thought it was something your IT department might want to get on!
Woot Engineering is here!
Do you mean bounces@woot.com or does it actually reference the FQDN of bounces.woot.com?
In either case, can you paste the reference so we can look into it?
Found it, investigating 
Yeah, the “mail from” address is [some long identifier]@bounces.woot.com. Since it’s a subdomain, your SPF record for woot.com doesn’t apply.
I don’t see an MX record for bounces.woot.com, either… weird! I thought for custom mail from, Amazon SES requires the mail from domain to point back to them.
Since the email is being sent from store-news@woot.com, it matches the outgoing allowed sender rule. It is the SMTP sender that is set differently. Don’t take this as gospel on how SES works 
But that is how I read it as succeeding.
If you follow the link from that page to “Setting a MAIL FROM domain”, step 7 says:
For Behavior if MX record not found , choose one of the following options:
- Use region .amazonses.com as MAIL FROM – If the custom MAIL FROM domain’s MX record is not set up correctly, Amazon SES will use a subdomain of amazonses.com . The subdomain varies based on the AWS Region in which you use Amazon SES.
- Reject message – If the custom MAIL FROM domain’s MX record is not set up correctly, Amazon SES will return a
MailFromDomainNotVerifiederror. Emails that you attempt to send from this address will be automatically rejected.
So it sounds like these messages shouldn’t even get through, but they are. So I guess I’m no SES expert, either!
Hey, you fixed it! 
We did! Thanks for letting us know!
We did! It took a bit to unravel the bits from the bytes, but we managed to turn them into a working word.
Quick catch on the fix, it went out the day of your comment.