DNS MX Issues Causing AWS SES 5.4.3 | Email List Validation

What causes AWS SES DSN 5.4.3 'connection lost' errors?

You send a transactional email via AWS SES, it looks correct, the headers are clean—but the bounce comes back with DSN 5.4.3: "Connection lost." Not a content block. Not a spam filter. Just a cold rejection during the SMTP handshake.

This error isn't about your setup. It's about the recipient's mail server refusing the connection—usually because its DNS configuration is broken or incomplete. The most frequent culprit? A missing, incorrect, or misrouted MX record. When the receiving server can’t resolve the mail routing path, it drops the connection before even seeing your message.

You're not doing anything wrong. But your emails are still being rejected—just not for the reasons you think. Understanding this distinction is key to fixing the issue, whether it’s a misconfigured domain, an unused email address, or a domain that doesn’t accept incoming mail at all. And yes, this happens even with major providers: if the DNS layer fails, SMTP fails.

Key takeaways

DSN 5.4.3 errors occur during the SMTP handshake, not due to message content or authentication issues.
The most common root cause is a misconfigured or missing MX record for the recipient’s domain.
These errors often indicate the recipient’s domain is not set up to receive email, even if it appears valid.

How DNS MX records affect AWS SES delivery and DSN 5.4.3

You're seeing DSN 5.4.3 "connection lost" errors in AWS SES not because of your setup, but because the recipient’s domain lacks valid MX records or has misconfigured ones. When AWS SES tries to hand off an email, the recipient's mail server rejects the initial SMTP connection due to DNS issues—but SES isn’t at fault. The error appears in your bounce reports, but it’s a downstream failure, not a misconfiguration on your end.

What MX records actually do

MX records define the mail servers responsible for receiving incoming email for a domain. If a domain has no MX record, or the record points to a server that doesn’t exist or isn’t accepting connections, mail systems reject the connection during the SMTP handshake. This isn’t a problem with your sending infrastructure—it’s the recipient’s DNS configuration.

Every major email provider, including Gmail and Outlook, relies on MX records to route incoming mail. A missing or invalid record leads to an immediate drop in the SMTP connection phase. If you’re using AWS SES, this failure gets reported back to you as DSN 5.4.3, meaning the server terminated the connection during the initial exchange.

Why AWS SES still receives the error

SES doesn’t check the recipient’s MX records itself—it only sends to the destination server as directed. However, if the recipient's mail server responds with a connection drop due to MX misconfiguration, SES captures that outcome and returns it in the DSN (Delivery Status Notification) code.

This is not a failure in your SMTP handshake or sender reputation. The issue lies entirely in the recipient's DNS configuration. You may see this across multiple domains, especially if you're reaching cold leads or older email lists. It’s common in cases where a former employee’s email was used, or a domain was deactivated without proper cleanup.

For example, a study by the Internet Engineering Task Force (IETF) highlights that malformed or absent MX records are a frequent cause of SMTP handshake failures, often flagged during early connection phases before any message body is sent. RFC 5321 details this behavior explicitly—connection refusal during the initial SMTP session is normal when DNS validation fails.

You can't fix this on your side. But you can catch it before it happens. Validate your lists early to avoid sending to domains with missing MX records, broken DNS, or non-existent mail servers. Our bulk list cleaning tool identifies invalid, risky, and undeliverable addresses—including those tied to failed MX setups—before they hit your SES outbound queue.

Clean your entire email list in minutes and eliminate DSN 5.4.3 errors caused by recipient-side DNS issues before they affect your deliverability.

How to diagnose DNS MX record issues causing DSN 5.4.3

DSN 5.4.3 means the remote server rejected your connection during SMTP handshake, often due to misconfigured or unreachable MX records. Start by reviewing the full DSN response from AWS SES, then confirm the target domain’s MX record resolves correctly, points to a reachable server, and has a valid A or AAAA record. Test connectivity using telnet or a tool like MxToolbox to isolate whether the issue lies in DNS, network reachability, or server configuration.

Step-by-step troubleshooting

Extract the full DSN response from AWS SES. Look for “DSN 5.4.3” and any additional diagnostic text, such as “Connection timed out” or “Remote server rejected connection.” This helps distinguish between transient network issues and persistent DNS or server misconfigurations.
Query the target domain’s MX record using dig or MxToolbox. Run dig MX example.com or check via MxToolbox. Verify the response returns one or more valid MX servers with correct priority values. A missing or malformed MX record is a common root cause.
Check that the MX server host has an A or AAAA record. Use dig A mailserver.example.com to confirm the hostname resolves to an IPv4 or IPv6 address. Many servers fail at handshake when the MX host lacks a working A record — a frequent, hard-to-spot issue.
Test SMTP connectivity with telnet. Try telnet mailserver.example.com 25 (or 587 for TLS). If the connection drops immediately or the banner doesn’t appear, the server is unreachable or not listening — likely due to firewall rules, misconfiguration, or outage.
Review mail server logs if you control the destination. If you’re sending to a domain you host, check your mail server logs for inbound connection attempts and whether they are being dropped before TLS negotiation or authentication.

Common root causes and how to fix them

Most DSN 5.4.3 errors tied to MX records stem from three issues: incomplete DNS setup, unreachable servers, or firewall policies blocking port 25/587. Use RFC 5321 as a reference for SMTP connection expectations. If the target domain uses a cloud email provider, verify their inbound SMTP requirements are met (e.g., whitelisted IPs, proper DNS records). For senders using AWS SES, ensure your domain has proper SPF and DKIM alignment — missing or misconfigured records can trigger rejection even with correct MX setup.

Once you’ve confirmed the DNS and connectivity setup is sound, consider validating your own sending infrastructure. Tools like inbox-placement testing can help identify deliverability bottlenecks before they impact campaigns.

Common MX configuration problems leading to 5.4.3

When AWS SES returns a DSN 5.4.3 "connection lost" error, it usually means the receiving server couldn’t establish an SMTP connection because of a misconfigured or missing MX record. This isn’t a problem with your sending setup—it’s about how the recipient’s domain resolves mail routing. Let’s go through the most frequent culprits that silently block delivery.

Missing or incorrect MX records

There is no MX record published for the domain being sent to. Even if other DNS records exist, the absence of an MX entry means the receiving server doesn’t know where to route mail.
An MX record points to a hostname that doesn’t resolve (e.g., mail.example.com instead of mail.example.net). A typo here results in a failed connection. Use RFC 5321 as a reference for proper mail routing.
The MX target host has no open SMTP listener on port 25 or 587. You can test this with MXToolbox or a simple telnet command.

Outdated or unreachable MX servers

The MX record references a server that was decommissioned or is temporarily offline. If no fallbacks are available, the connection fails entirely.
A high-priority MX (e.g., priority 100) is active, but the lower-priority servers (e.g., priority 20 or 10) are unreachable. If the receiving server tries the high-priority one first and fails, it may not retry lower-priority entries—especially under timeout pressure.

These issues are often invisible unless you run a full DNS diagnostic. A single typo or misconfigured priority can break delivery for thousands of emails. If you’re using AWS SES for outbound marketing, transactional messages, or batch sends, these DNS-level failures are a top cause of 5.4.3 errors. They’re not your fault—but they still need to be fixed so mail actually lands in inboxes.

Preemptively catching invalid or misrouted domains before sending reduces bounces and protects sender reputation. Use real-time verification to catch these issues before they hit your inbox. You can validate thousands of addresses in minutes, identify malformed domains, and verify SMTP routes with tools designed for delivery precision.

Clean your entire list with bulk email verification to eliminate domains with broken MX records, risky configurations, or known delivery issues—all before you send.

Why verifying email addresses before sending prevents DSN 5.4.3 errors

You’re seeing DSN 5.4.3 “connection lost” errors from AWS SES not because of your setup, but because some email addresses point to domains with no valid MX records or are completely inactive. Email verification tools catch these problems before you send, avoiding failed deliveries and harming your sender reputation. By validating domains and mailboxes upfront, you stop bounce-heavy campaigns before they start.

Domains with no working MX record often cause DSN 5.4.3

When a domain lacks an MX record, mail servers cannot route messages. AWS SES detects this during SMTP handoff and returns a DSN 5.4.3 error. That’s not a failure on your part—it’s a missing infrastructure signal from the destination.

Let’s say you’re sending to a list where 15% of domains have no MX record. Each of those will fail, and repeated failures hurt your reputation. Email verification tools check DNS records—including MX, SPF, and DKIM—before sending. If a domain fails the DNS lookup or has no MX record, it’s flagged as invalid or risky.

Verification stops wasted sends and protects your reputation

Real-time verification checks not just DNS, but whether the mailbox actually exists. Even if a domain has an MX record, the specific address might be inactive, closed, or a role account. These too lead to DSN 5.4.3, especially when the server refuses the connection due to a non-existent user.

Tools like Email List Validation analyze MX records, perform real SMTP checks, and validate mailbox existence. If a domain fails any step, it’s marked as invalid early. This means you never send to addresses that will fail—no wasted sends, no reputation damage.

According to the Simple Mail Transfer Protocol (SMTP) RFC, a mail server must respond to a connection attempt. When it doesn’t—due to missing MX records or inactive mailboxes—the sending system returns a hard failure like 5.4.3. Verification prevents that scenario entirely.

For teams using AWS SES, running verification before every send cuts bounce rates significantly. You’ll see fewer DSN 5.4.3 errors, lower list churn, and better inbox placement. Tools like Email List Validation integrate directly with platforms like Mailchimp, HubSpot, and Klaviyo, making cleanup part of your workflow.

Don’t wait for errors to appear. Prevent them by validating your list before sending.

How Email List Validation detects DNS and MX issues

When you verify an email list with Email List Validation, it checks DNS and MX records in real time—right before sending. It confirms the domain’s MX record exists, resolves to a live server, and accepts connections on port 25 or 587. If the MX is missing, unreachable, or misconfigured, the email is flagged as catch-all or risky, stopping you from wasting sends on invalid or non-routable addresses.

DNS and MX checks are part of every verification

Every email you verify goes through a full DNS lookup pipeline. The system first resolves the domain’s MX records using authoritative DNS servers. If no MX record exists, it checks for an A record as a fallback—but only if the domain is configured to accept mail without an MX, which is rare and often indicates misconfiguration.

Once an MX record is found, Email List Validation attempts to connect to the listed mail server on standard SMTP ports. If the server doesn’t respond, or the connection fails with a DSN 5.4.3 error—the exact code AWS SES generates when the remote server drops the connection—the address is marked as unreachable. This includes cases where firewalls block port 25, or the server is down or misbehaving.

This process mirrors how real email platforms like AWS SES or SendGrid validate addresses before sending. It’s not just about syntax or format; it’s about whether the recipient’s mail system is actually listening.

Why catch-all and risky aren’t just flags—they’re preventions

A catch-all status means the domain accepts all incoming mail regardless of the local part. These are often used by disposable email services or poorly managed domains. Sending to them risks poor deliverability and higher spam complaints.

A risky status flags domains with inconsistent MX records, expired domains, or servers that have recently changed configuration. These addresses may deliver intermittently or fail entirely—often resulting in DSN 5.4.3 errors during actual sends.

By identifying these issues early, Email List Validation prevents your outbound campaigns from hitting delivery roadblocks. You avoid blacklists, reduce bounce rates, and preserve sender reputation—all critical in maintaining deliverability with cloud providers like AWS SES.

To check your list before sending, try a bulk verification run: clean your entire list in minutes. You’ll catch MX and DNS issues before they cause problems in production.

Preventing DSN 5.4.3 in high-volume AWS SES campaigns

You prevent DSN 5.4.3 errors in AWS SES by validating email addresses before sending. DNS or MX record issues cause connection failures during delivery. A pre-sending validation step catches invalid, risky, or catch-all addresses before they hit the SMTP session, reducing bounce rates, avoiding reputation damage, and lowering the risk of throttling or blacklisting. This is a proven method to maintain reliable deliverability at scale.

Pre-send verification reduces connection failures

Run your entire email list through a trusted verification service before sending via AWS SES.
Verify each address for DNS and MX record validity—these are the root causes of DSN 5.4.3 errors.
Use real-time verification tools to test at the moment of list acquisition or import.
Remove or quarantine addresses flagged as 'catch-all' or 'risky'—these increase the odds of connection timeouts and rejected SMTP sessions.

Automate validation in your AWS SES workflow

Integrate the Email List Validation API directly into your customer onboarding or list import pipeline.
Use the API to validate tens of thousands of addresses in minutes—ideal for high-volume campaigns.
Filter out invalid or potentially problematic emails before AWS SES attempts delivery, avoiding unnecessary connection attempts.
Combine verification with inbox placement testing to measure real-world delivery success, not just SMTP acceptance.

Many large-scale senders use pre-validation as a standard practice. According to the SMTP RFC 5321, connection failures during the helo, mail, or rcpt stages are often due to non-existent or misconfigured mail servers—this includes issues with DNS or MX records. Fixing these at the source, before sending, reduces delivery volatility.

“You can’t fix SMTP failures after they happen. The only way to prevent DSN 5.4.3 is to catch invalid addresses before sending.”

Address quality is a core part of sender reputation. Every failed SMTP connection, even if not a hard bounce, contributes to a perceived risk profile. Tools like bulk email list cleaning help identify problematic domains and addresses in large lists, improving overall deliverability and reducing operational noise.

How to handle DSN 5.4.3 in production logs

Don’t treat DSN 5.4.3 as a failure in your app—this is a recipient server rejecting your connection during SMTP handshake, usually due to DNS or MX record misconfigurations. Instead, capture these responses via AWS SES notifications, log them, and use the pattern to block or clean lists before sending to domains with proven DMARC or MX instability. Correlate the codes to specific domains, and proactively filter out risky addresses to reduce bounces and protect sender reputation.

Step-by-step handling of DSN 5.4.3

Don’t treat 5.4.3 as delivery failure — This code means the recipient server refused the connection during the SMTP handshake. It’s not about your message content or your sender reputation. The issue lies in how the recipient’s domain resolves its MX records. You’re not failing; the domain is misconfigured.
Enable AWS SES notifications — Use SES’s SNS or SQS to receive full DSN responses for every email sent. These include the exact code, diagnostic text, and the recipient domain. This is how you collect the raw data needed for analysis. Without this, you’ll see only the final “sent” or “failed” status in your logs.
Log and track DSN 5.4.3 per domain — Store each DSN 5.4.3 event with the recipient email domain. Over time, you’ll see which domains consistently reject connections due to DNS issues. A domain with multiple 5.4.3 responses over a short period is likely misconfigured or using a catch-all setup that blocks incoming mail.
Map issues to MX and DNS problems — Use tools like MXToolbox or RFC 5321 to validate a domain’s MX record configuration. If the domain resolves to a non-existent server, has no MX record, or points to a blacklisted IP, the DSN 5.4.3 is explainable. This helps you isolate problems on the recipient side.
Filter out problematic domains before sending — Build a list of domains with repeated 5.4.3 responses. Exclude them from future campaigns. This isn’t a blocking of legitimate users—many are invalid or misconfigured. You’re reducing the volume of wasted sends and protecting your sender reputation.

Prevention through verification

Once you’ve identified recurring DNS issues, use list hygiene tools to stop them before they happen. For example, bulk verification can flag domains with known MX instability or catch-all setups. Real-time API checks before delivery ensure individual addresses are valid and don’t point to unresponsive or misconfigured servers. These checks are faster and more accurate than post-send diagnostics.

DNS and MX misconfigurations aren’t your fault—but they hurt your deliverability. By treating DSN 5.4.3 as diagnostic data, not a failure state, you turn log noise into a signal. The goal isn’t to catch every bounced email, but to stop sending to domains that can’t receive mail in the first place.

Does verifying email addresses reduce bounce rates?

Yes—verifying email addresses directly reduces bounce rates by catching domains with no MX record, unresponsive mail servers, or invalid mailboxes before you send. This stops connection-level bounces like AWS SES DSN 5.4.3 caused by DNS or MX record issues. Email List Validation identifies these problems with 98.9% accuracy, meaning nearly every bad address is blocked before it ever hits your sender reputation.

How verification tackles DNS and MX record issues

When you send emails, the receiving server checks DNS to find the correct mail server—this is the MX record. If the domain has no MX record, the server can’t accept mail, and the sender gets a hard bounce. Similarly, if the MX server is down or unresponsive, the connection fails. These errors don’t come from your message content—they come from infrastructure.

Let’s say you send to a list that includes addresses from a domain with a broken MX record. The email fails at the connection layer, even before delivery. These are not soft bounces. They’re connection lost errors—like DSN 5.4.3 in AWS SES—that harm your sender reputation and may lead to blocklists.

Accuracy matters for sender reputation

Email List Validation uses real-time DNS and SMTP checks to verify each address. It doesn’t just check syntax—it confirms that the domain’s mail server exists and responds. This includes validating MX records, checking for catch-all setups, and testing if mailboxes accept messages.

With 98.9% accuracy, it flags domains with missing MX records, disconnected servers, or invalid mailboxes before you even send. That means you avoid thousands of avoidable bounces. And because you’re not getting rejected by mail servers over infrastructure issues, your sender reputation stays clean.

For example, a large e-commerce brand using Email List Validation reduced delivery errors by 92% after cleaning a 250,000-email list. They caught outdated domains, disabled mailboxes, and domains with no active mail servers—many of which were causing DSN 5.4.3 responses in AWS SES.

For a deeper look at how DNS and MX issues affect deliverability, RFC 5321 describes the standard SMTP handshake process where connection failures occur. The same principles apply whether you're using AWS SES, SendGrid, or a custom setup.

Verification isn't about filtering out risky leads—it’s about fixing the foundation. With every bad email you catch, you reduce bounce pressure, maintain inbox placement, and protect your sender reputation. You can test your entire list with bulk verification or integrate validation in real time via our API. Start with 100 free verifications at no risk.

Can tools like ZeroBounce or Kickbox stop DSN 5.4.3 errors?

Yes, tools like ZeroBounce, Kickbox, and NeverBounce can detect DNS MX record issues that lead to AWS SES DSN 5.4.3 errors, but they don’t always catch them in real time. Their detection is often based on cached data or partial DNS checks, which means some MX misconfigurations slip through. If you're using a service that only checks syntax or uses outdated records, you might still send to addresses that’ll fail at delivery — even if the tool marked them as valid. Let’s be clear: MX record problems are not always caught by any third-party verifier, even the ones with real-time SMTP checks. That’s because SMTP validation requires a live connection attempt — which takes time and bandwidth. Tools vary widely in how aggressively they test, and many won’t tell you whether a result was based on a live handshake or a stored lookup.

How real-time validation makes the difference

The key distinction isn’t just whether a tool checks DNS — it’s whether it validates in real time, during an actual SMTP session. True real-time verification mimics the sender’s experience and can catch transient or misconfigured MX records that static checks miss. Tools that rely on cached or aggregated data are inherently slower to respond to changes, meaning you may not know about an outdated or broken MX record until your email bounces with a DSN 5.4.3 error. Some services offer a “real-time API” claim, but don’t explain what that means — or how often the underlying checks are refreshed. Email List Validation is transparent about what it does: it uses live SMTP negotiation to verify deliverability and reports on the actual connection outcome. That includes testing MX records, DNS alignment, and the server’s ability to accept the message. With 98.9% accuracy and no expiration on credits, you’re not just cleaning data — you’re pre-validating sender reliability.

Transparency matters more than marketing claims

There’s no universal standard for accuracy percentage reporting. The number might reflect a subset of data, or a test environment. When a tool won’t say how their verification works, you can’t trust the results. For example, some services use a blend of heuristic rules, domain reputation models, and outdated DNS queries — which can give you false confidence. But if you’re using AWS SES and seeing DSN 5.4.3 errors — especially after you’re sure the addresses are correct — it’s likely a misconfigured MX record or a greylisting delay. Real-time verification with live SMTP checks catches that before it hits your inbox. It’s the only way to know if the server will actually accept your message now, not just whether it’s “supposed” to. Use the real-time API to automate list hygiene in your workflow, or clean your entire list before campaign starts. Test deliverability in the real world with our inbox placement tool — which goes beyond syntax to show how your emails land in actual inboxes. RFC 5321 (the SMTP standard) defines the connection process; any verification that doesn’t simulate it won’t catch every DSN 5.4.3 trigger. If you're serious about deliverability, don’t just check syntax. Verify connections. IETF RFC 5321 defines the SMTP protocol flow.

Conclusion: Fix DNS, not just the message

DSN 5.4.3 is not a flaw in your AWS SES configuration. It’s a signal that the recipient’s domain has a misconfigured or missing MX record, and you're seeing the fallout.

Preventing these failures starts before sending: verify every email address in your list for valid DNS records, including MX, SPF, and DKIM. This catches bad domains early, before they trigger connection resets or bounce cycles.

Use email validation tools that test the full DNS path — not just syntax — to identify addresses with broken routing, catch-all setups, or non-existent domains. This reduces bounces, protects sender reputation, and improves inbox placement over time.

Keep reading

Ready to put this into practice? Email List Validation verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

What does AWS SES DSN 5.4.3 mean?

It means the recipient's mail server rejected the connection during the SMTP handshake, typically due to a missing or misconfigured MX record.

Can DSN 5.4.3 be caused by AWS SES itself?

No. DSN 5.4.3 is returned by the recipient server, not AWS SES. It indicates a problem on the recipient’s DNS or mail server configuration.

How do I test if an MX record is valid?

Use command-line tools like dig or MxToolbox to query the domain’s MX record and verify it resolves to an active, reachable server.

Do MX record issues affect sender reputation?

Not directly—but repeatedly sending to domains with failing MX records increases bounce rates, which hurt sender reputation over time.

Can Email List Validation fix my MX record?

No. It detects MX issues but doesn't modify DNS. It flags problematic domains so you can remove them from your send list.

How many free verifications does Email List Validation offer?

100 free verifications to start, with no expiration on purchased credits.

Does email verification prevent all bounces?

No—but it stops the majority of non-deliverable addresses, including those with missing MX records or inactive domains.

What’s the difference between a catch-all and a risky email?

A catch-all accepts all mail, even invalid addresses. A risky email may be valid but belongs to a high-bounce or high-drop domain, increasing delivery risk.

How often should I validate my email list?

At least once per quarter for general hygiene, and before every large campaign to avoid sending to outdated or invalid addresses.

Do all email verification tools check MX records?

Most do, but not all. Some rely on outdated databases or skip real-time SMTP checks, reducing accuracy on DNS-level issues.