MailFixIt

Amazon SES custom MAIL FROM

Fix SES MailFromDomainNotVerified

Amazon SES custom MAIL FROM verification depends on records at the MAIL FROM subdomain, not the apex domain. Compare the exact regional MX issued by SES and check SPF at that same subdomain before touching the domain's normal inbound MX records.

Check SES MAIL FROM DNS free

Required evidence: the SES region, custom MAIL FROM subdomain, fallback behavior and exact MX target from SES. MailFixIt does not guess a regional endpoint.

What to verify

  1. The MX owner equals the custom MAIL FROM subdomain, for example bounce.example.com, not the apex unless that is truly your configured identity.
  2. The MX preference and target exactly match the value from SES for the chosen region.
  3. An SPF record is published at the MAIL FROM subdomain. This is checked separately from the apex SPF policy.
  4. The selected SES behavior on MX failure is recorded as UseDefaultValue or RejectMessage; it changes the delivery consequence but does not replace the missing DNS record.

Safe repair sequence

  1. Copy the values from the SES identity in the correct region.
  2. Preserve the existing MX and TXT values for rollback.
  3. Correct only the records at the custom MAIL FROM subdomain. Do not replace the apex MX used for receiving normal email.
  4. Recheck DNS, wait for SES verification, then send a fresh message and inspect its Return-Path and authentication headers.

What this check does not prove

A matching MX and SPF record show public DNS configuration, not that SES has already refreshed its verification state or that a new message has aligned authentication. The actual Return-Path and DKIM signature require a fresh message-header check.

Official reference: Amazon SES custom MAIL FROM domains.