MailFixIt

Amazon SES email configuration guide

Amazon SES: inbound email not reaching receipt rules

Mail reaches SES receipt rules only when the exact recipient domain routes to the receiving endpoint in the configured AWS Region.

Problem description

A provider setup symptom may look like:

Mail sent to the SES receiving domain does not reach its active receipt rules.

Check the sending domain

What this usually means

The recipient domain does not route to the SES receiving endpoint for the configured Region, or SES accepted the message but no active receipt rule and action handled it.

Fix it

  1. Confirm that SES email receiving is available in the AWS Region you selected.
  2. Verify the exact domain identity in that Region and publish the Region-specific receiving MX endpoint at the recipient domain.
  3. Make sure an active receipt rule set matches the intended recipient.
  4. Check the rule actions and permissions for S3, SNS, Lambda, WorkMail, or the chosen destination.
  5. Send a new message, then inspect SES metrics, rule actions, CloudWatch, and destination logs.

A custom MAIL FROM MX record has another purpose: it handles bounce and complaint feedback for outbound SES mail. It does not by itself deliver ordinary inbound messages into receipt rules.

Common mistake

Using the correct SES endpoint for the wrong Region, or publishing the custom MAIL FROM feedback MX at the recipient domain, will not create the intended inbound flow.

What MailFixIt can check

MailFixIt can inspect public MX DNS. It cannot see receipt rules, AWS permissions, or whether an action completed.

Use the related MX guide if public routing is missing or still points to another receiver.

Frequently asked questions

What does MailFixIt check for Amazon SES?

It can show whether the recipient domain publicly routes to the expected SES host. AWS account state, receipt rules, and action permissions require SES administration.

Should I replace every existing DNS record with the provider values?

No. Confirm the exact record type and owner, preserve unrelated legitimate services, and change only the provider-controlled record required for the intended mail route.

Related email diagnostics

Email delivery delayed or rejected after a DNS migrationDiagnose email that stopped arriving after a DNS change. Compare public MX records with the intended provider and avoid false alarms for mail gateways. SPF is not configured for the envelope sender domainDiagnose SPF missing on a bounce or MAIL FROM subdomain. Check the exact envelope domain, add only authorized senders, and verify safely. DKIM public key record is invalid or revokedDiagnose an invalid or revoked DKIM public key record. Check the exact DKIM selector in public DNS before replacing a sender-provided key.

Primary sources: Amazon SES email receiving setup.