Why does AWS SES return 550 5.1.3 Domain Unknown for valid inbound emails?

You send a message to an email address on a domain you’ve confirmed is active and reachable. AWS SES replies with 550 5.1.3: "Domain unknown." It’s frustrating — especially when you’re certain the address is real. But the error isn’t about the email address. It’s about the domain.

Think of AWS SES as a postal service that only accepts mail for addresses it has officially registered. If the domain isn’t set up as a receiving domain in SES, the system rejects the message, regardless of the recipient’s actual validity. This happens even when the domain has working MX records, SPF, and DKIM — but lacks proper SES registration.

Key takeaways

  • The 550 5.1.3 error occurs because the domain is not configured as a receiving domain in AWS SES, even if it is otherwise valid.
  • Valid domains can still fail if they lack proper DNS records (MX, SPF, DKIM) or aren't verified in the SES console.
  • Verifying a domain in SES isn't just a formality — it’s required for inbound email processing, regardless of the domain’s external operational status.

Is the domain really unknown, or is it a misconfiguration?

You're likely seeing the 550 5.1.3 "domain unknown" error because your domain hasn't been added as a verified receipt source in AWS SES—despite the domain being valid and properly configured. This is a common oversight when teams set up only outbound email sending and forget inbound routing requirements. The error doesn't mean the domain is unreachable or invalid; it means SES doesn’t recognize it as a recipient.

Why "domain unknown" often means "not verified"

When you send email to an address on a domain not listed as a verified receipt source in SES, the service treats it as if the domain doesn’t exist, even if DNS records are correct and MX records are set. This is a design feature, not a failure. The error occurs before any DNS lookup or server-level validation—SES just doesn’t know the domain is allowed to receive mail through it.

Let’s say you’re using SES for outbound marketing campaigns and later decide to receive support emails via a dedicated address like [email protected]. You might assume that because the domain is already set up with proper SPF, DKIM, and MX records, SES can accept incoming mail. But no—the domain must be explicitly verified as a receiving source within the SES console. Without this step, incoming emails fail at the first gate.

How to fix it: verify your domain for inbound receipt

To resolve this, go to the Amazon SES console, navigate to “Receipt Rules” or “Verified Identities,” and confirm your domain is listed as a verified receipt source. If it isn’t, add it. Once verified, inbound emails should be processed, and the 550 5.1.3 error disappears.

It’s easy to overlook this step when your team’s focus is on sending scalability. But sending and receiving are different flows. The same domain that handles outbound mail doesn’t automatically receive it through SES. This is standard behavior across cloud email platforms. For more on how email routing works at scale, refer to AWS’s documentation on email receipt rules or the SMTP standard (RFC 5321), which defines how mail transport handles recipient validation.

If you’re dealing with inbound email streams in production, ensure your infrastructure accounts for both sending and receiving configurations. Misconfigurations like this aren’t rare—they’re expected when teams don’t design with full inbound workflows in mind. The fix is straightforward, once you know where the gap is.

What happens when your AWS SES inbound rules fail due to domain unknown errors?

When your AWS SES inbound email rules fail with a 550 5.1.3 "domain unknown" error, all incoming messages to that domain are rejected outright with a hard bounce. This breaks any email-dependent workflow—like support ticket intake, form submissions, or automated confirmations—leaving users stranded and conversions lost. Even legitimate senders cannot deliver, creating silent failures that can go undetected without monitoring.

Why inbound email disruption matters

That hard bounce isn't just technical noise. It means customer support requests vanish into the void, form submissions never reach your team, and automated response systems don’t trigger. If you’re relying on inbound emails for account verification or order confirmations, your entire pipeline stalls. A single misconfiguration can delay support responses by hours or days, eroding trust and reducing conversion rates.

Worse, these failures often go unnoticed. Unlike bounce-backs from misaddressed emails, this error affects every incoming message to a domain—valid or not. Without proper logging or monitoring, you might not realize the issue until customers start calling or your team notices gaps in reported activity.

Root causes behind the 550 5.1.3 error

The 550 5.1.3 error typically means the receiving mail server (in this case, your SES setup) doesn’t recognize the domain as valid for inbound mail. This most commonly happens when the domain isn’t properly verified in SES, or when it lacks an MX record pointing to AWS’s inbound mail servers. The SMTP protocol requires strict DNS alignment, and any mismatch triggers this rejection.

For example, if you’ve set up an outbound-only SES configuration and forget to verify the domain for inbound use, or if your DNS MX record is misconfigured, the server will reply with "domain unknown." You can verify your setup using tools like MXToolbox or check the RFC 5321 specification on SMTP error codes.

Even if you're using an existing domain, it's easy to overlook these requirements during migration or setup. For instance, if you’ve changed DNS providers or reconfigured your email infrastructure, you might have dropped the MX configuration without realizing it—especially if you’re not actively testing inbound delivery.

Let’s be clear: this isn’t a problem with the sender’s email. It’s a configuration issue on your end that blocks all incoming messages, regardless of content or source. If you’re experiencing these errors, verify your domain’s MX records, ensure SES inbound access is enabled, and confirm that the domain is listed in your AWS account’s verified domains.

How to verify and configure your domain for inbound email in AWS SES

You can resolve the "550 5.1.3 domain unknown" error by verifying your domain in AWS SES inbound mail setup. This involves adding specific DNS records to authorize AWS to receive emails on your domain. Once the records propagate, AWS confirms the domain and enables inbound email routing.

Set up domain verification in AWS SES

  1. Log in to the AWS Console and navigate to Amazon SES. This is where AWS manages email sending and receiving for your account.
  2. Go to the 'Receiving' section and click 'Verify a new domain'. This activates the inbound email feature for your domain, preparing AWS to accept messages.
  3. Enter your domain name (e.g., example.com) and click 'Verify'. AWS generates a set of DNS records required to confirm domain ownership and enable inbound email routing.
  4. Add the DNS records to your domain's DNS provider—typically through your hosting provider or domain registrar. The records include TXT and CNAME types used for identity verification and mail routing.
  5. Wait for DNS propagation—typically 1–5 minutes, though up to 60 minutes is common. You can check if the records are live using tools like MXToolbox or DNSChecker.
  6. Return to the SES console to confirm the domain appears as "Verified". AWS checks the DNS records automatically and updates the status once they’re visible.

What to do if verification fails or takes too long

If your domain doesn’t verify after 60 minutes, double-check your DNS records for typos or missed entries. Some providers delay propagation beyond 60 minutes. Ensure you’re using the latest records from AWS—not cached or outdated versions.

Once verified, you can configure receipt rules to direct incoming emails to an S3 bucket, Lambda function, or another service. Without a valid verification, AWS will reject inbound emails with a 550 5.1.3 domain unknown error, even if the syntax appears correct.

Inbound email setup is also part of a larger deliverability strategy. Misconfigured domains don’t just block mail; they harm sender reputation. Always validate your list before sending—use tools like bulk email list cleaning to identify outdated or invalid addresses before sending campaigns.

What DNS records are required for inbound email in AWS SES?

You need two DNS records to configure inbound email in AWS SES: an MX record pointing to receive.amazonses.com with priority 10, and a TXT record at receive._domainkey.example.com with the value provided by AWS. These are the only mandatory records for receiving emails.

Setting up MX and TXT records correctly

First, create an MX record with the name receive.amazonses.com and priority 10. This tells sending servers to route inbound mail to AWS SES. Next, add a TXT record at receive._domainkey.example.com using the value AWS provides during setup. This DKIM-like record authenticates incoming messages.

While SPF and DKIM are not required for inbound delivery, they improve reputation and authenticity checks. SPF, for example, reduces spoofing attempts and helps avoid false positives in filtering systems. DKIM adds cryptographic verification that messages weren’t altered in transit.

Avoiding configuration conflicts

Check for duplicate or conflicting records. Multiple MX records can cause routing issues, and overlapping SPF entries may result in validation failures. Use tools like MxToolbox to verify your DNS setup before sending test emails.

If you're still seeing 550 5.1.3 "domain unknown" errors, the domain might not be verified in AWS SES, or DNS propagation may not have completed. Wait up to 72 hours after DNS changes, and ensure the domain is confirmed in the AWS SES console.

For teams managing list hygiene or validating sender domains, a full email validation system can help catch malformed or invalid email addresses before they cause delivery issues. You can clean large lists before sending to reduce bounce rates and improve overall deliverability.

Can invalid email addresses cause 550 5.1.3 errors in inbound processing?

No—invalid email addresses alone do not cause 550 5.1.3 "domain unknown" errors. That error signals a problem with your domain’s DNS configuration or AWS SES inbound rules, not with individual email addresses. If you’re seeing this at scale, the issue lies in infrastructure setup, not list hygiene.

Understanding the difference: domain vs. address-level errors

SMTP error codes like 550 5.1.3 are domain-level rejections. They mean the recipient domain isn’t recognized by the receiving mail server. This is different from a rejection at the address level (e.g., 550 5.1.1 — mailbox unknown), which would trigger only for specific invalid addresses, not entire domains.

When AWS SES returns 550 5.1.3 for inbound emails, it’s saying: “We don’t know this domain.” That’s not about whether the email address exists—it’s about whether the domain is configured correctly to receive mail. This is governed by DNS records like MX and SPF. If those are missing or misconfigured, mail servers reject the message early, before even checking the local part (the username).

Common root causes in AWS SES inbound setups

Most failures here stem from one of three issues: missing or incorrect MX records, misconfigured DKIM or SPF for the domain, or an inbound mailbox rule that hasn’t been properly associated with the correct domain in AWS SES.

For example, if you’ve set up an IAM role to process inbound emails but haven’t properly linked it to a verified domain in SES, the service will reject incoming mail with a 550 5.1.3 error. Even if every email address in the message is valid, the domain itself remains “unknown” to the receiving system.

It’s also worth checking that the domain you’re using for inbound processing is fully verified in the AWS SES console. Domains must be verified via DNS TXT records before inbound mail can be accepted. Without that verification, AWS rejects all inbound traffic with a 550 5.1.3 error.

For clarity, the RFC 5321 standard defines 5.1.3 as “The mail system cannot find the specified domain.” This is not a recipient error—it’s a domain not found. You can validate your domain configuration using tools like MxToolbox or RFC 5321 to confirm your DNS setup aligns with SMTP expectations.

If your list has invalid addresses, they’ll generate different error codes—like 550 5.1.1 or 550 5.1.8—depending on the recipient server. But they won’t trigger a domain-level “unknown” response. Fixing domain-level errors requires verifying DNS records, properly setting up inbound rules, and confirming domain authorization in AWS SES—not cleaning your email list.

How can you test if your inbound email setup in AWS SES works?

You can verify your AWS SES inbound email setup by sending a real message to an email address on a domain you’ve verified in SES, then checking S3 or CloudWatch logs for receipt status and error codes. Use public DNS tools to confirm MX and TXT records resolve correctly. If you see a 550 5.1.3 “domain unknown” error, it usually means DNS records aren’t properly published or domain verification is incomplete. Double-check your setup with real-world validation.

Test your inbound setup step by step

  1. Send a real email to an address on your verified domain. Use an existing user email (e.g., [email protected]) and send a simple message through any email client. This simulates actual inbound traffic and triggers SES’s inbound processing pipeline.
  2. Check CloudWatch Logs or S3 delivery notifications. SES logs inbound events in CloudWatch or S3 buckets if you’ve enabled them. Look for MessageReceived events and filter by your domain. If the message doesn’t appear, the error likely lies in DNS or verification.
  3. Verify DNS records are publicly resolvable. Use tools like MxToolbox or DNS Checker to confirm your domain’s MX and TXT records are live and resolve correctly. A missing or malformed MX record will cause the 550 5.1.3 error.
  4. Confirm your domain is fully verified in SES. Go to the SES console > Identities > verify your domain. Ensure the status shows “Verified.” If it shows “Pending,” wait for DNS propagation or re-verify. An unverified domain is rejected at the SMTP level.
  5. Re-check MX and TXT records for typos or missing values. Common issues include incorrect subdomain prefixes (e.g., emailinbound._domainkey.yourdomain.com), missing text content, or expired TTL values. Use RFC 5321 as a reference for proper SMTP behavior and record formatting.

When logs show no receipt, verify domain state

If logs remain empty after 15–30 minutes, the message likely wasn’t accepted by the mail server. This usually means the domain isn’t validated, the MX record is misconfigured, or the sending source is blocked.

You can reduce false negatives and improve inbound reliability by verifying your entire email list for accuracy first — especially if you’re building a customer feedback or support system. Using a tool like bulk email list cleaning can help eliminate invalid addresses that might otherwise trigger unexpected delivery behavior.

What role do domain validation and list hygiene play in inbound email success?

You need valid domains and clean email lists to avoid 550 5.1.3 "domain unknown" errors in AWS SES. Invalid domains, catch-all setups, or missing MX records cause immediate rejection. Checking domains before ingestion stops misrouted emails, reduces bounce rates, and lowers system overhead. You’re not just cleaning data—you’re preventing failures upstream.

Preventing failures before they reach SES

When you send inbound emails through AWS SES, the system checks DNS records—specifically MX records—to route messages. If a domain has no valid MX record, SES returns a 550 5.1.3 error. This isn’t a misconfiguration; it’s a hard block by the receiving system. Validating domains early stops these errors at the source, before they reach SES.

The same applies to catch-all domains and disposable email addresses. These often don’t accept inbound messages properly, or their providers reject them outright. If your list includes domains like temporarymail.com or catchall.example.net, those emails will fail—even if the address is technically valid. Email List Validation checks for these red flags before you send.

Integrating real-time verification into your workflow

Let’s say your application collects emails via forms or imports lists. If you pass raw data directly into SES, you’re trusting unverified domains to deliver. That’s risky. Instead, integrate a real-time verification API before ingestion.

Email List Validation’s real-time email verification API checks syntax, domain existence, MX records, and whether a domain accepts inbound messages—all in under 500ms. It flags domains with no MX, known rejection policies, or known disposable patterns. This means you never send to a domain that will fail.

For example, if your user sign-up flow includes a list verification step, you can filter out non-deliverable entries before they hit SES. This keeps your sender reputation strong, avoids reputation penalties from high bounce rates, and reduces load on your email infrastructure.

By addressing domain validity and list hygiene early, you’re not just avoiding 550 errors—you’re building an inbound system that’s reliable from the start. This is how enterprises scale inbound workflows without hitting wall-of-error messages.

You prevent AWS SES inbound email rules from failing with a 550 5.1.3 domain unknown error by validating email addresses before they reach your system. Invalid domains, catch-all setups, role accounts, and disposable email providers often trigger such errors. Email List Validation checks each address in real time—98.9% accuracy—and blocks problematic emails before they hit AWS SES, reducing bounce rates and improving inbound reliability.

Real-time verification catches bad addresses before they land

When you use the Email List Validation API, every incoming email is checked for validity milliseconds after submission. It checks DNS records, confirms mailbox existence, and flags risky addresses such as admin@, support@, or tempmail.org types. This stops domain unknown errors at the source.

For example, a catch-all email address may accept any recipient, but it’s often misused by spammers. AWS SES sees this as a risk and may reject messages. With real-time validation, those are blocked before routing, avoiding unnecessary bouncebacks and protecting your sender reputation.

Clean existing data with bulk verification to strengthen inbound hygiene

You don’t have to wait for delivery failures to clean your list. Bulk email list validation lets you scrub outdated, incorrect, or non-existent addresses in advance. Many inbound email systems receive data from legacy sources, third-party forms, or CRM exports full of dead ends.

Using bulk email list cleaning, you remove entries tied to non-existent domains or disposable services before they reach AWS SES. This not only reduces failed deliveries but ensures only valid, deliverable addresses are processed—keeping your inbound pipeline reliable and efficient.

Industry standards like RFC 5321 and RFC 5322 outline how mail servers validate domains and reject malformed requests. When your inbound system processes addresses that don’t resolve, it triggers these checks. Tools like MxToolbox and Spamhaus monitor known bad domains—a practice Email List Validation aligns with through its DNS and reputation checks.

This isn’t about perfecting a system after it breaks. It’s about catching failures before they happen. You’re not just fixing bounces; you’re improving inbox placement and preventing reputational harm through better address hygiene. For organizations running high-volume inbound workflows, this is a practical step toward consistent delivery.

What to do if domain verification in AWS SES fails despite correct DNS

If you're getting a 550 5.1.3 “domain unknown” error in AWS SES despite correctly configured DNS records, the issue is likely a typo in the domain name, incomplete propagation, or a temporary system delay. Double-check the exact spelling in the SES console, verify your MX and TXT records are live using a public DNS lookup tool, wait at least 60 minutes for propagation to settle, and retry the verification. If it still fails, contact AWS Support with your verified logs.

Step-by-step troubleshooting

  1. Verify the domain name is spelled exactly as it appears in the SES console. A single character error—like using example.com instead of example.com—will cause verification to fail. If you use a subdomain, ensure it’s fully qualified and matches the DNS record scope.
  2. Confirm your DNS records are published and correct. Use a public DNS lookup tool like MXToolbox or DNSChecker.org to verify both the SPF TXT record and the MX record for your domain. Misconfigurations here will prevent AWS from validating ownership.
  3. Wait for DNS propagation to complete. DNS changes can take up to 60 minutes to propagate across all resolvers globally. If you just updated your records, wait at least one full hour before retrying. Propagation can be slower during peak load or if your DNS provider has slow TTL propagation.
  4. Retry verification after confirmation. In the SES console, initiate the verification process again once your DNS records are confirmed live. AWS will query multiple resolvers, so a delay between your local check and global rollout can break the handshake.
  5. Contact AWS Support if it persists. After waiting and re-trying, if the error remains, gather all diagnostic logs from AWS CloudWatch and submit them to AWS Support. Include the domain, your verification attempt timestamp, and any relevant error codes. This helps identify issues with AWS’s internal validation system.

When DNS is correct but still failing

If records are accurate and propagation is complete, the problem may lie in AWS’s internal validation cache or a misconfigured inbound rule. Double-check that no conflicting rules in your email receiving setup (like a VPC endpoint or an S3-based receipt rule) are silently dropping messages. Also, ensure the domain is not on a blocklist—a check via Spamhaus can help rule out reputation-based blocking.

When you’re validating email deliverability at scale, it’s helpful to test end-to-end performance. If your workflows involve sending to large lists, use a real-time email verification service to catch invalid or problematic addresses before they impact your sender reputation. Try bulk email list cleaning to ensure your delivery metrics stay strong.

Fixing inbound email flow with AWS SES starts with domain trust

The 550 5.1.3 "domain unknown" error signals that AWS SES does not recognize the incoming domain as valid. This is not a misconfiguration—it’s a security check enforcing domain trust.

Domain verification in AWS SES is mandatory for inbound mail. Skipping it leaves your system exposed to spam and invalid sources. Proper verification ensures only authorized domains can send to your receipt rules.

Preventing invalid domains before they reach your system reduces false positives, keeps logs clean, and improves overall inbox placement. The most effective strategy is to validate domains and emails proactively—before integration.

Keep reading

Ready to put this into practice? Email List Validation verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

Can I use AWS SES inbound email without verifying the domain?

No. SES requires every domain used for inbound mail to be verified in the console before it accepts messages.

Why does AWS SES return 550 5.1.3 for a domain I control and operate?

The domain must be explicitly verified in the SES console. Even if the domain is functional and has valid DNS, SES won’t accept inbound mail unless it’s added as a receiving domain.

Does a catch-all email address cause 550 5.1.3 errors?

No. Catch-all domains are not the cause of 550 5.1.3 errors. The error occurs when the domain itself isn’t verified in SES, regardless of how it handles messages.

How long does it take for DNS changes to take effect for AWS SES inbound email?

DNS propagation typically takes 1 to 5 minutes, but may take up to 60 minutes depending on the DNS provider and TTL settings.

Can email verification tools prevent 550 5.1.3 errors?

Yes, by filtering out invalid or unverifiable domains before they reach your system. Tools like Email List Validation help prevent misconfigured domains from entering workflows.

Is DKIM required for inbound email in AWS SES?

No, DKIM is not required for inbound email handling. However, it improves sender reputation and helps prevent spoofing.

What’s the difference between 550 5.1.3 and 550 5.7.1 errors in AWS SES?

550 5.1.3 means the domain is not recognized as a verified receiving domain. 550 5.7.1 usually indicates message content or sender reputation issues.

Can I verify multiple domains in AWS SES for inbound email?

Yes. You can verify up to 10 domains for inbound email per AWS account, with the same setup process for each.

What happens if I delete a verified domain in AWS SES?

All inbound email to that domain will be rejected with a 550 5.1.3 error until the domain is re-verified.

How do I know if my domain is already verified in AWS SES?

Go to the AWS SES console, navigate to 'Receiving', and check the 'Verified domains' list. If the domain is not listed, it is not verified.