Fix 550 5.1.3 Domain Unknown in AWS SES

Why does AWS SES return 550 5.1.3 'domain unknown'?

You’re sending from a verified domain in AWS SES, but your emails bounce with a 550 5.1.3 error: “domain unknown.” You didn’t change anything. The setup worked yesterday. Now it’s broken.

The issue isn’t your content. It’s not the mail server. It’s the DNS records that AWS SES uses to validate your domain — and they’re either missing, incorrect, or not yet propagated.

Every email sent through AWS SES must prove ownership of the sending domain. That proof lives in your domain’s DNS records. If AWS can’t find or read the required records — SPF, DKIM, or MX — it rejects the send with a “domain unknown” error. This happens when records aren’t published, are misconfigured, or take time to sync after a change.

Fixing it isn’t guesswork. It’s a precise technical check: verify your DNS records match AWS SES’s expectations. We’ll walk through what each record does, how to check them, and how to fix common mistakes in minutes — so you stop debugging and start delivering.

Key takeaways

550 5.1.3 "domain unknown" means AWS SES cannot validate your domain's DNS records
SPF, DKIM, and MX records must be correctly published and fully propagated before sending through AWS SES
Even small DNS configuration errors—such as incorrect syntax or missing subdomain records—can trigger this error

What DNS records must be correct for AWS SES to accept your domain?

If your AWS SES domain is getting a 550 5.1.3 "domain unknown" error, the issue is almost always a missing or malformed SPF, DKIM, or TXT record. You must publish a valid SPF record to authorize AWS SES to send on your behalf, set up DKIM for message authentication, and ensure your domain is verified via a TXT record in DNS. Without these, SES will reject your emails or mark them as suspicious. Let’s break down what’s required.

SPF: Authorize AWS SES to send on your domain

Include include:amazonses.com in your SPF record to authorize AWS SES as a valid sender.
Ensure your SPF record does not exceed 10 DNS lookups—this includes any included records. Exceeding this limit can invalidate the entire record.
Use only one SPF record per domain. Multiple SPF records will cause validation failure.

DKIM: Prove your emails are authentic

Set up a DKIM record using the selector and public key provided by AWS SES during domain verification.
DKIM signs outbound emails cryptographically, helping inboxes identify legitimate messages from your domain.
DKIM is not required for sending but is best practice—without it, your email is more likely to be flagged as spam.

MX and TXT: Handle inbound and verification

MX records are only necessary if you plan to receive email through AWS SES. For sending only, they’re optional.
Create a TXT record specifically to verify domain ownership in AWS SES. This is required to enable sending.
Use a TXT record with a name like your-domain.com and a value provided by AWS upon verification attempt.
Multiple TXT records are allowed, but each must be correctly formatted and not conflict with others.

For a deeper look at how DNS affects email deliverability, refer to RFC 5321 (SMTP) and RFC 7208 (SPF). These documents define the standards that services like AWS SES use to validate sender legitimacy.

Even with the right DNS setup, some emails may still fail silently. If you're sending large volumes, run inbox placement tests to confirm your messages are landing in inboxes and not spam folders. You can also verify your list’s health with tools like bulk email list cleaning to catch invalid or risky addresses before sending.

Step-by-step: How to verify and fix DNS records for AWS SES

You can fix the 550 5.1.3 "domain unknown" error in AWS SES by verifying your domain through DNS records. Log in to the AWS SES console, verify your domain, then add the four TXT records AWS provides exactly as shown—SPF, DKIM, and two verification records. Wait 10–30 minutes for propagation. Then check back in AWS SES; status should update to "Verified."

Go to the AWS SES console and navigate to the 'Domains' section. If your domain isn’t listed, you need to verify it first. This step ensures AWS recognizes your domain as authorized to send mail through its service.
Start verification by clicking "Verify a New Domain" and enter your domain name (e.g., yourdomain.com). AWS generates unique DNS records for SPF, DKIM, and domain validation. These records verify both your identity and your domain’s permission to send via SES.
Copy the four TXT records AWS provides: one for SPF, one for DKIM, and two for domain validation. These are case-sensitive and must be copied in full—any typo or missing quote breaks verification. You can find the exact format in RFC 5321 and RFC 5322, which define how mail servers validate sender legitimacy.
Access your DNS provider (Route53, Cloudflare, GoDaddy, etc.). Log in and navigate to your domain’s DNS management. Add each TXT record exactly as provided, using the full value including quotes. Avoid trimming whitespace or modifying formatting.
Wait for DNS propagation. In practice, this usually takes 10–30 minutes. While DNS changes can take up to 72 hours to fully propagate globally, most providers update within hours. Use tools like dnschecker.org to verify when records are live.
Return to AWS SES and refresh the domain list. If all records are correct and propagated, the status will change to "Verified." Only then can you send mail from your domain through SES without the 550 5.1.3 error.

Why DNS records matter for deliverability

Without proper DNS records, receiving mail servers won’t recognize your domain as authorized. This triggers hard bounces, blacklists, and inbox placement failures—even if your email content is clean. SPF prevents spoofing, DKIM ensures message integrity, and domain validation confirms ownership. Skipping any step risks deliverability.

Preventing future errors

Always double-check TXT record values before saving. Misconfigured records cause repeated 550 errors. If verification fails, use bulk email list cleaning to catch invalid domains in your send list—this reduces bounce risks before send time, improving sender reputation.

How DNS propagation delays can make 550 5.1.3 errors persist

Even with correct DNS records, you might still see 550 5.1.3 "domain unknown" errors in AWS SES because DNS changes don’t propagate instantly. Some ISPs and email providers cache DNS responses for up to 48 hours, meaning your updated records may not be visible everywhere yet. Wait at least 24 hours after making changes before assuming the setup failed.

DNS caching and propagation aren't failures—they're normal

When you update your domain's DNS records, the change doesn’t reach every network at once. Public resolvers and email gateways often cache responses to improve performance. This caching period can last up to 48 hours, depending on the TTL (Time to Live) set in your DNS zone. During that time, some providers may still route mail to your domain based on the old, stale record—even if it no longer exists.

Let’s say you just added an SPF or DKIM record for AWS SES. Until the new record propagates globally, you’ll get 550 5.1.3 errors from providers that haven’t refreshed their cache. This isn’t a configuration error—it’s a delay in the internet’s distributed system. Many large ISPs, including Comcast and Verizon, commonly delay DNS lookups by 24–48 hours.

Check propagation before troubleshooting

Before diagnosing your DNS setup, verify whether the change has propagated. Use tools like dig or nslookup to query your domain from multiple geographic locations. For example, run dig TXT yourdomain.com and check if the SPF or DKIM record appears as expected. If it doesn’t, you might still be looking at cached data.

Alternatively, use MxToolbox to test DNS records from multiple global vantage points. These tools show real-world propagation status across the internet, not just local cache. If you see inconsistency—some locations show the record, others don’t—that’s a sign of ongoing propagation.

If propagation appears complete but errors still occur, then you’re likely dealing with a deeper misconfiguration. But if the record is still missing in certain areas, give it time. Pushing more aggressively at this stage does nothing but increase bounce rates and degrade sender reputation.

For email lists you're sending to, always validate addresses early—especially when sending via AWS SES. You can reduce bounce rates caused by outdated or invalid domains by using a service like bulk email list cleaning to identify and remove problematic addresses before sending.

Why SPF and DKIM records must be specific, not generic

You can't just copy a generic SPF or DKIM record from another provider and expect it to work with AWS SES. AWS requires your SPF record to explicitly include its sending IPs, and your DKIM keys must be generated by AWS itself—using a static key from another service breaks signing. A malformed or overly broad record leads to a 550 5.1.3 domain unknown error, even if the domain exists.

SPF: One record, specific mechanisms, no includes without SES

Many users paste an SPF record like v=spf1 include:spf.protection.outlook.com ~all and think it’s enough. But AWS SES doesn’t trust those includes unless they explicitly cover AWS’s IP ranges. A generic include won’t pass validation, because AWS checks for your own domain’s allowed sending sources—and only your own. You must ensure the record includes include:amazonses.com or include:_amazonses.yourdomain.com. If you’re using multiple third-party services, combine all mechanisms into a single, correctly ordered line.

DKIM: Generate keys in AWS, don’t reuse them

DKIM keys are unique per domain and signing configuration. If you generate a DKIM key in another system and paste it into AWS, it will fail. AWS must issue the DKIM records during domain verification. Once generated, they must be published as TXT records exactly as AWS provides. Reusing a key from a different sender—like a Mailchimp or SendGrid key—won’t work, even if the format looks similar. Each email platform manages its own key pair.

Another common mistake: having multiple SPF records. This breaks validation because DNS rules allow only one SPF TXT record per domain. If you list multiple v=spf1 entries, mail servers treat it as invalid and reject delivery. The solution? Combine all mechanisms—includes, redirects, and your own IPs—into a single, properly ordered SPF record.

For example, a valid SPF record for AWS SES might look like: v=spf1 include:amazonses.com ~all. That's all you need—no extra includes, no additional TXT records. If you're managing thousands of domains or building a sending infrastructure, you can verify your DNS setups safely with tools like email list validation before sending.

For a deeper technical reference, see RFC 7208 (SPF), which specifies that a domain must have a single, authoritative SPF record. You can also check your DNS configuration with tools like MXToolbox or Spamhaus to ensure your records are consistent and correctly published across name servers.

How list hygiene and email verification prevent 550 5.1.3 errors

Even with perfect DNS records, sending to invalid domains—like typos or defunct ones—results in 550 5.1.3 errors from AWS SES. These bounces hurt your sender reputation and reduce deliverability. You can prevent them by cleaning your list before sending, using tools that validate domains at the DNS level to catch issues before delivery.

Invalid domains still trigger 550 errors

Let’s be clear: correct DNS records only matter for domains that actually exist. If your list includes exmple.com instead of example.com, AWS SES will reject the message with a 550 5.1.3 error—even if your SPF, DKIM, and DMARC are flawless. This isn’t a configuration issue. It’s a bad domain.

These kinds of mistakes aren’t rare. A study by Return Path found that up to 20% of email lists contain invalid or non-existent domains. Without verification, those errors go undetected until after the send, wasting resources and damaging your overall sending reputation.

Verify domains early to avoid bounces and protect your reputation

Email validation tools like bulk verification check each domain at the DNS level before you send. They confirm whether a domain actually exists, if it accepts mail, and whether it’s a role account or disposable email. This catches issues you wouldn’t see in DNS configuration alone.

By removing invalid domains, role addresses (like admin@ or info@), and disposable emails, you reduce the risk of hard bounces. That protects your sender reputation—the metric AWS SES uses to determine whether to accept or reject your messages. A clean list is the foundation of reliable deliverability.

It’s also worth noting that even a single hard bounce can trigger sender reputation penalties. According to RFC 6650, mail systems use feedback loops to assess sender behavior. Consistent bounces, even from a single invalid address, can lead to filtering or throttling.

Proactively verifying your list—before using it in AWS SES—means fewer bounces, higher inbox placement, and a more stable sending reputation. You're not just fixing DNS records; you're fixing the quality of the data behind them.

Real-time verification API: Stop sending to domains with broken records

You can prevent 550 5.1.3 "domain unknown" errors in AWS SES by checking DNS records, mail server reachability, and catch-all responses before sending. Use the Email List Validation API during signup, onboarding, or campaign prep to catch invalid domains in real time—no more wasted sends on domains with broken MX or SPF records.

How it works: Validate domains before they trigger delivery failures

Integrate the real-time verification API into your signup, onboarding, or campaign workflows to check each email address as it’s added.
It checks DNS records—including MX, SPF, and DKIM—on the fly, identifying domains with missing or misconfigured entries that cause 550 5.1.3 errors.
It detects catch-all domains that accept all emails, even invalid ones, which falsely appear valid but lead to high bounce rates.
It verifies mail server reachability by simulating a real SMTP conversation, confirming the domain’s mail server is operational and accepting connections.
It returns clear verdicts: valid (safe to send), invalid (bounced or syntax error), catch-all (risk of spam), or risky (poor reputation or misconfigured records).

Automate clean lists with existing tools

Connect the API with Mailchimp, HubSpot, Klaviyo, or SendGrid to auto-validate new signups and clean your lists before sending campaigns.
Use the bulk verification tool for existing databases—clean hundreds of thousands of addresses in minutes.
Prevent sender reputation damage: a single undeliverable email to a malformed domain can hurt your deliverability score, especially in AWS SES.
Industry-standard practices like RFC 5321 (SMTP) and RFC 5322 (email format) are enforced by the API’s underlying checks—no guesswork.
See real-world impact: domains with broken DNS records are a major cause of hard bounces, which AWS SES monitors closely and penalizes over time.

“DNS misconfigurations account for a significant portion of email delivery failures in cloud-based email services like AWS SES.” — RFC 5321 (SMTP)

By catching invalid domains early, you reduce bounce rates, protect sender reputation, and avoid the 550 5.1.3 error that derails campaigns. The only time you need to fix DNS records is when domain owners are involved—but you don’t need to send to domains that are already broken.

Why sender reputation suffers when DNS records fail

You can’t build a trustworthy sender reputation in AWS SES if your DNS records are incorrect — invalid records cause delivery failures, which increase bounce rates. Spam filters and ISPs track these patterns, and repeated bounces signal poor list hygiene. Even a small number of invalid addresses, if repeated, can trigger throttling or suspension. Proper DNS records are the foundation: without them, your domain never gets past the first hurdle.

How DNS errors trigger reputation damage

When DNS records like MX, SPF, or DKIM are misconfigured, email delivery fails before content even reaches the inbox. These failures result in hard bounces, which AWS SES logs and monitors. If your bounce rate exceeds a few percent over time, SES starts to treat your sender domain as unreliable. Even one bounce might not seem like much — but when it's part of a pattern of sending to non-existent or poorly maintained domains, it starts to erode trust.

Let’s say you send to 10,000 addresses, and 100 of them return with a 550 5.1.3 “domain unknown” error. That’s a 1% bounce rate — below the usual threshold for automatic suspension. But if this happens across multiple mailings without cleanup, ISPs interpret it as poor sender hygiene. The more consistent the failure, the more likely your domain gets flagged as risky. According to the RFC 5321, MTAs are expected to reject messages to domains they cannot resolve, so a failed DNS lookup isn’t just technical — it’s part of standard email validation.

Why prevention starts with DNS and data quality

Correct DNS records help prevent bounces, but they only work if your email list is accurate. If you’re sending to expired domains or misspelled addresses, no DNS configuration will save delivery. That’s why real-time verification and bulk cleaning are essential. You can validate domain existence, check mailbox reachability, and filter out inactive or disposable email addresses before sending. Doing this reduces your bounce rate to just a few tenths of a percent — a baseline for good reputation.

Tools like bulk email list cleaning detect invalid domains and malformed addresses early, so you never send to a “domain unknown” in the first place. This proactive step stops bounces before they begin, maintaining healthy sender reputation metrics. Even one failed delivery can hurt if it’s not isolated — but with proper data hygiene, those failures stay rare, and your reputation stays intact.

How to test inbox placement before full send campaigns

You can test inbox placement before sending to your entire list by simulating real delivery conditions with tools like Email List Validation’s inbox-placement feature. It checks how your messages land in actual inboxes across major providers—Gmail, Outlook, Apple—using real domains and authentic sender setups, so you can catch 550 5.1.3 domain unknown errors and other deliverability issues before they hit your audience.

Simulate real-world delivery with realistic test conditions

Don’t test with only your domain—test with real domains that reflect how your emails will be received in the wild. This includes checking how your sender IP and domain configurations handle filtering, authentication, and routing. Weak DNS records, missing SPF/DKIM/DMARC, or poor sender reputation can all lead to rejection or spam filtering, even if your message is technically valid. Tools that simulate real inboxes let you see how those factors play out in practice.

Imagine sending to 10,000 users only to have 30% bounce or land in spam. That’s avoidable. Using Email List Validation’s inbox-placement testing, you run a controlled test that mirrors how actual subscribers experience your email. The system uses a variety of real domains and mail servers, including those with strict filtering policies, to identify whether your message is flagged or blocked early. This mirrors what services like Spamhaus or MXToolbox assess, but with actionable insight into your specific setup.

Fix issues before you send — avoid 550 errors at scale

You’ll see exactly where your email fails: is it a malformed DNS record? An incorrect SPF alignment? Or a low sender reputation? Some providers check if a domain exists in their system before accepting mail—this is the source of the 550 5.1.3 "domain unknown" error in AWS SES. Testing reveals these points of failure long before you send to your full list.

Let’s say your test shows 40% of messages land in spam folders. That’s not a minor adjustment—it’s a red flag. You’ll know to check your authentication records, warm up your IP, or review how your sending practices appear to filtering systems. Fix it during testing, not after a full campaign fails.

Using real domain testing and inbox placement analysis isn’t optional if you're serious about deliverability. It’s how you ensure your AWS SES messages are recognized, accepted, and delivered—before you send. With Email List Validation’s inbox-placement tool, you can simulate thousands of deliveries in minutes, with results that reflect real user experiences. See how your setup holds up, and fix what’s broken before you spend time and reputation on a bad send.

The truth about DNS record validation — no magic fix, just checks

You can’t fix DNS records with a tool. No automation will update your zone file for you. Email verification services like Email List Validation test your DNS setup, flag missing or incorrect records like SPF, DKIM, or MX, and show you exactly what’s wrong — but you must update the records yourself in your DNS provider’s dashboard. There’s no substitute for manual verification, and no magic fix.

What verification tools actually do

Tools like Email List Validation don’t touch your DNS. They only test whether the records you’ve configured are correct, present, and valid. They check for syntax errors, expired entries, or missing DNS types like TXT or CNAME. When they report an issue — such as "domain unknown" — it means the receiving server can’t resolve your domain or verify your sending identity.

Let’s be clear: if you’re seeing a 550 5.1.3 "domain unknown" error in AWS SES, the problem is likely your domain’s DNS records. The sender identity isn’t recognized because the domain isn’t properly registered in the DNS system. That’s not a bug in the email service — it’s a configuration gap.

How to use verification tools correctly

Use tools to validate pre-send. Test your domain’s DNS setup and your email addresses before you send to a large list. Run a bulk verification on your list to catch invalid or problematic domains early — and check your own domain records with inbox placement tests.

For example, you can use Email List Validation to audit your entire sender domain, confirm all required records are in place, and catch inconsistencies before sending. It won’t patch your domain, but it tells you which records are missing, like a missing SPF or an expired DKIM key. Run a bulk verification to test your list and domain setup in one go.

That said, DNS records aren’t static. If your configuration changes — say, you switch hosting providers or update a domain — revalidate your records. A single misaligned or missing TXT record can block delivery. For reference, RFC 5321 defines the SMTP protocol for handling MAIL FROM and HELO domains, and RFC 7208 outlines how SPF works — both critical to understanding why DNS validation matters.

Summary: Fix 550 5.1.3 by validating DNS—and your list

The 550 5.1.3 error in AWS SES means your domain’s DNS records weren’t recognized during delivery attempts. This typically stems from misconfigured SPF, DKIM, or MX records.

Use tools like dig or MxToolbox to confirm your DNS records are published and propagated. Ensure each record matches exactly what AWS SES expects—no typos, missing values, or incorrect syntax.

Even with correct DNS, sending to invalid or dormant addresses harms deliverability. Clean your list with real-time email validation to catch bad domains, catch-alls, and non-routable addresses before they trigger bounces or harm sender reputation.

Keep reading

Ready to put this into practice? Email List Validation verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

What does 550 5.1.3 'domain unknown' mean in AWS SES?

It means AWS SES cannot verify the domain you're sending from because the required DNS records (SPF, DKIM) are missing, incorrect, or not yet propagated.

How long does DNS propagation take after setting up AWS SES records?

Typically 10 to 30 minutes, but can take up to 72 hours depending on DNS TTL settings and ISP caching.

Can I use Email List Validation to fix DNS errors in AWS SES?

No — it cannot fix DNS records, but it can test whether your domain’s DNS records are valid and detect issues before sending.

Why does my domain show as 'verified' in AWS SES but still gets 550 5.1.3 errors?

Verification means DNS records were found at the time of setup. If records are later removed or changed, the domain becomes invalid again.

Does having SPF and DKIM prevent 550 5.1.3 errors?

Yes, if both are correctly published. Missing or invalid SPF/DKIM records are the most common cause of the 550 5.1.3 error.

Can role accounts (e.g. [email protected]) cause 550 5.1.3 errors?

No — role accounts don’t cause DNS errors, but they are often catch-alls or unmonitored, leading to high bounce rates that hurt deliverability.

Do disposable email domains cause 550 5.1.3 errors in AWS SES?

No — they usually don’t cause 550 5.1.3, but they increase bounce rates and waste sends. Use email validation to remove them.

How does Email List Validation check domain validity?

It performs real-time DNS checks, validates SPF/DKIM records, probes mail servers, and assesses inbox placement risk.

Can I test inbox placement before sending with Email List Validation?

Yes — the service includes inbox-placement testing that checks delivery through real email providers.

How accurate is Email List Validation’s verification?

It has a 98.9% accuracy rate, based on real-world tests and verified against live mail servers.