MailFixIt

Amazon SES email configuration guide

Amazon SES: DKIM record not verifying

Amazon SES cannot verify one or more DKIM records for the selected identity and Region, or the message used another identity.

Problem description

A provider setup symptom may look like:

DKIM record not verifying after a provider DNS change.

Check the sending domain

What this usually means

The DKIM records do not match those generated for the SES identity in the AWS Region that sent the message, or the application used a different identity or Region.

Fix it

  1. Open Amazon SES in the sending Region and select the exact verified domain identity.
  2. Copy every Easy DKIM CNAME, or the exact BYODKIM record if that is the configured mode.
  3. Publish the records in the authoritative DNS zone without a duplicated domain suffix, proxying, or a changed record type.
  4. Keep the full generated selector set so SES can rotate keys; remove only records confirmed obsolete for the same identity.
  5. Wait for SES to show DKIM as successful, send a new message from that Region, and confirm its d=, s=, and dkim=pass values.

Common mistake

SES identities and verification status are Region-specific. A correct record for one identity does not prove that another Region, delegated sender, or From domain uses it.

What MailFixIt can check

MailFixIt can inspect public DKIM data for a supplied selector. It cannot see AWS account or Region state.

Use the related DKIM guide for a missing CNAME target or malformed public key.

Frequently asked questions

What does MailFixIt check for Amazon SES?

It can inspect a generated selector in public DNS and detect missing or malformed records. Amazon SES must confirm identity status and active signing.

Should I replace every existing DNS record with the provider values?

No. Confirm the exact record type and owner, preserve unrelated legitimate services, and change only the provider-controlled record required for the intended mail route.

Related email diagnostics

Email delivery delayed or rejected after a DNS migrationDiagnose email that stopped arriving after a DNS change. Compare public MX records with the intended provider and avoid false alarms for mail gateways. SPF is not configured for the envelope sender domainDiagnose SPF missing on a bounce or MAIL FROM subdomain. Check the exact envelope domain, add only authorized senders, and verify safely. DKIM public key record is invalid or revokedDiagnose an invalid or revoked DKIM public key record. Check the exact DKIM selector in public DNS before replacing a sender-provided key.

Primary sources: Amazon SES Easy DKIM and BYODKIM management.