MailFixIt

Amazon SES custom MAIL FROM

Amazon SES MailFromDomainNotVerified: SES could not read the required MAIL FROM MX record

Amazon SES custom MAIL FROM verification depends on records at the MAIL FROM subdomain, not the apex domain. Compare the exact regional MX issued by SES and check SPF at that same subdomain before touching the domain's normal inbound MX records.

Problem description

Amazon SES reports the following verification error:

MailFromDomainNotVerified: Amazon SES could not read the MX record required to use the specified MAIL FROM domain.

Run this automated test on my domain

Enter your domain. MailFixIt checks the relevant DNS records automatically and shows the evidence.
Required evidence: the SES region, custom MAIL FROM subdomain, fallback behavior and exact MX target from SES. MailFixIt does not guess a regional endpoint.

What to verify

  1. The MX owner equals the custom MAIL FROM subdomain, for example bounce.example.com, not the apex unless that is truly your configured identity.
  2. The MX preference and target exactly match the value from SES for the chosen region.
  3. An SPF record is published at the MAIL FROM subdomain. This is checked separately from the apex SPF policy.
  4. The selected SES behavior on MX failure is recorded as UseDefaultValue or RejectMessage; it changes the delivery consequence but does not replace the missing DNS record.

Safe repair sequence

  1. Copy the values from the SES identity in the correct region.
  2. Preserve the existing MX and TXT values for rollback.
  3. Correct only the records at the custom MAIL FROM subdomain. Do not replace the apex MX used for receiving normal email.
  4. Recheck DNS, wait for SES verification, then send a fresh message and inspect its Return-Path and authentication headers.

What this check does not prove

A matching MX and SPF record show public DNS configuration, not that SES has already refreshed its verification state or that a new message has aligned authentication. The actual Return-Path and DKIM signature require a fresh message-header check.

Frequently asked questions

What causes SES MailFromDomainNotVerified?

Amazon SES could not use the configured custom MAIL FROM domain as expected. A missing or mismatched MX record, wrong Region target or DNS publication problem can be involved.

Can I use any inbound MX target for an SES custom MAIL FROM domain?

No. Use the exact feedback MX target and preference documented by Amazon SES for the identity’s Region. Do not substitute the domain’s ordinary inbound mail exchanger.

Related email diagnostics

Amazon SES: Return-Path does not match the configured custom MAIL FROM domainCompare an Amazon SES custom MAIL FROM domain with the Return-Path from a sent message and check MX and SPF at that exact subdomain. Amazon SES DkimStatus PENDING: DKIM records not detectedFix Amazon SES DkimStatus PENDING by checking all three Easy DKIM CNAME records for the same identity and AWS Region.

Primary sources: Amazon SES custom MAIL FROM.