How to Configure DNS for Inbound Email Flow in AWS SES to Avoid 550 5.1.3

What does the 550 5.1.3 error mean in AWS SES inbound email flow?

You send an email via AWS SES, and it bounces back with a 550 5.1.3 error. Not a 554, not a 421—specifically 550 5.1.3. You check your SES configuration, your sending limits, your reputation. Everything looks fine. So why did it fail?

The answer isn’t in your setup—it’s in the recipient’s DNS. This error means AWS SES tried to deliver your message, but the recipient’s domain rejected it because its mail infrastructure can’t accept incoming email. The failure is on their end, but when it happens at scale, it hurts your sender reputation.

Think of it like sending a letter to a house that has no mailbox. The post office (AWS SES) did its job correctly, but the destination is unreachable because the address lacks the necessary infrastructure to receive mail.

Key takeaways

• The 550 5.1.3 error is a recipient-side delivery failure, not a problem with your AWS SES outbound configuration.
• It often results from missing or misconfigured MX records, incorrect SPF/DKIM/DMARC policies, or a lack of inbound mail acceptance.
• High volumes of 550 5.1.3 bounce responses, even if not your fault, can degrade your sender reputation over time.

Why does AWS SES return 550 5.1.3 instead of a softer bounce?

When AWS SES returns a 550 5.1.3 error, it’s because the receiving mail server performed a strict DNS check and found no valid MX record or a conflicting policy. This triggers an immediate hard rejection. Unlike a temporary soft bounce, this error means the message is permanently undeliverable — no retries occur. The underlying reason is AWS SES's compliance with RFC 5321 and RFC 5322, which require mail servers to validate the recipient's domain before accepting a message.

How DNS validation triggers permanent rejection

Before accepting any inbound email, AWS SES checks the recipient's domain using standard DNS lookups. If no MX record exists, or if the domain has conflicting policies (like a restrictive SPF or DMARC policy without a valid email endpoint), the mail server treats it as invalid. This is not a guess — it’s a hard rule built into the email delivery stack.

Let’s say you send a message to a user at example.com. The receiving server queries DNS and finds no MX record. It doesn’t wait. It rejects the message with a 550 5.1.3 code. That’s permanent. There’s no queue to retry, no grace period. The message dies at the door.

It’s not a soft bounce — it’s a hard failure

Many users expect a soft bounce when delivery fails — a temporary error that gives the system time to retry. But 550 5.1.3 is never soft. It’s a hard failure by design.

According to the IETF’s RFC 5321, servers must reject messages when a recipient address appears invalid *at the DNS level*. This isn’t AWS SES being aggressive. It’s just following standard email protocols. The error means the address doesn’t exist on a valid, publicly reachable mail server.

Some tools can help you catch this early. If you’re sending to a large email list, validating each address for DNS existence and delivery readiness can prevent hundreds of 550 5.1.3 errors. You can verify lists at scale with tools like bulk email list cleaning to ensure domains are live and properly configured.

Sending to a domain with no MX record or an inconsistent policy isn’t just risky — it’s a waste of bandwidth and reputation. Catching these issues before sending keeps your sender reputation intact. For more on how to test deliverability across providers, visit inbox placement testing. It helps you see where your messages land — before you send.

How to configure DNS for inbound email flow in AWS SES to avoid 550 5.1.3

550 5.1.3 errors when receiving inbound email via AWS SES usually stem from missing or incorrect DNS records. To fix this, ensure your domain’s MX record points to a valid mail server that accepts inbound messages, verify SPF allows AWS SES as a receiving source (if applicable), confirm DKIM is either properly signed or not enforced, and check that DMARC policies aren’t blocking legitimate inbound mail. Test your DNS configuration before relying on it.

Step-by-step DNS setup for inbound email with AWS SES

1. Confirm your domain has a valid MX record for inbound mail. If you’re using AWS SES to receive messages, the MX record must point to a mail server capable of handling inbound email. AWS SES does not act as a mail server; it only receives inbound mail on your behalf if you’ve configured it properly. Without a functioning MX record, incoming mail fails to route.
2. Check if SPF includes mechanisms allowing AWS SES to receive mail. While SPF is primarily for outbound mail, receiving systems may validate it for inbound flow. If your SPF record restricts incoming mail to specific sources, ensure AWS SES’s IP ranges or the include:amazonses.com mechanism is added. This is rare for pure inbound setups but may still apply if you're using DMARC or receiving mail via multiple services.
3. Verify DKIM is either absent or correctly implemented. DKIM signatures must match the domain and public key published in DNS. Invalid or missing DKIM can cause rejection by receivers, especially in highly secure environments. If you're not signing outbound mail, it's better to omit DKIM rather than publish a broken signature.
4. Review DMARC policies to avoid blocking inbound mail. A DMARC policy like rua=mailto:[email protected]; p=reject will reject any mail that fails SPF or DKIM checks. This can block legitimate inbound mail from AWS SES if validation fails. For inbound flows, use p=none to monitor, not block, and adjust only after confirming alignment.
5. Test DNS resolution before sending mail. Use tools like MXToolbox or SMTP RFC 5321 to validate MX, TXT, and SPF records. Look for missing, malformed, or inconsistent records. A single typo can cause the 550 5.1.3 error.

Proactive checks and monitoring

Even after setup, inbound mail can fail silently. Let’s test the flow: send a test message from an external address to your SES-receiving address and track the response. If you get a 550 5.1.3, check the error details in the bounce notification. You’ll often find DNS-related clues.

To catch problems early, validate your email list for deliverability risks—especially if you’re sending to or receiving from known high-failure domains. Use a reliable email validation solution to identify issues before they impact your inbound pipeline. Clean your list with bulk email verification to improve both send and receive reliability.

Common DNS misconfigurations that cause 550 5.1.3 errors

550 5.1.3 errors occur when a receiving mail server rejects your inbound email due to DNS issues. You're likely missing an MX record, have overly restrictive SPF, or a DMARC policy blocking legitimate emails. Let’s walk through the most common culprits.

Missing or invalid MX record

If your domain has no MX record, the mail server doesn’t know where to deliver incoming messages. This is a basic requirement—without it, no inbound email can reach you. Check your DNS zone using tools like MXToolbox or DNSCheck.net to confirm an MX record is present and points to a valid mail server.

SPF, DMARC, and relay issues

• SPF policy set to -all without proper allowlisting — Using v=spf1 -all blocks all mail unless explicitly allowed. If you’re using AWS SES as a relay, you must include include:amazonses.com to allow inbound delivery from AWS.
• DMARC policy set to reject without proper alignment — DMARC reject can unintentionally block valid emails if the From domain doesn’t align with the sending server’s SPF or DKIM. This is common when using third-party services like AWS SES for outbound email, but not for inbound.
• SPF doesn’t include the sender’s IP or proxy relay — If you’re sending through a relay server (even a proxy), that server’s IP must be included in your SPF record. Otherwise, the receiving server flags the email as untrusted.
• Catch-all address with no inbox capacity — A catch-all email address (e.g., @yourdomain.com receiving all mail, even invalid addresses) can trigger 550 5.1.3 if the mailbox isn’t actively receiving. This may cause rejection due to policy or volume limits.

These errors don’t always show up in logs immediately, but they compound over time. Even one incorrect DNS setting can trigger consistent 550 5.1.3 failures, especially when receiving from large providers like Gmail or Outlook.

Pro tip: Use a tool like RFC 7208 (SPF) or RFC 7483 (DMARC) to review your record syntax and alignment requirements. Misconfigured records are often the root cause of delivery delays.

Preventing these issues starts with validation. Use a bulk verification service like bulk email list cleaning to identify outdated or malformed addresses before sending—this helps reduce delivery failures at the source, whether inbound or outbound.

What happens if you ignore 550 5.1.3 errors in your email flow?

Ignoring 550 5.1.3 errors — a hard bounce indicating a permanently invalid email address — leads to higher bounce rates, damages your sender reputation over time, triggers rate-limiting or blocking by email providers, and ultimately reduces your inbound email delivery, even for valid messages. These errors are not temporary; they signal a final failure and must be addressed.

High bounce rates erode sender reputation

Every 550 5.1.3 error counts as a hard bounce. Senders with persistent high bounce rates are flagged by major providers as unreliable. This affects your standing with services like Gmail, Outlook, and Amazon SES itself, which use bounce history as part of their sender reputation models. The more hard bounces you accumulate, the more likely future emails will be filtered or rejected.

According to industry standards documented in RFC 5321, hard bounces like 550 5.1.3 are treated as permanent failures. Ignoring them doesn’t just hurt deliverability—it compounds the issue across your entire domain’s reputation. Once that reputation drops, recovery is slow and painful.

Delivery failures persist even for valid emails

As your bounce rate climbs, email providers may begin throttling or outright blocking your inbound mail. This isn’t limited to the invalid addresses; even legitimate emails sent to valid domains start getting deprioritized. You’ll see volume drop sharply across your inbound flow, despite no change in content or intent.

This isn’t a warning you can delay. Once an address returns 550 5.1.3, it should be removed immediately. There’s no recovery path. These are not temporary network issues. They indicate a malformed address, an address that no longer exists, or a domain that blocks incoming messages.

Proactively filtering these errors before they enter your flow is key. You can validate your list in bulk using tools like email list cleaning or integrate real-time validation into your signup process via our API. Preventing hard bounces before they happen keeps your DNS and sender reputation healthy. Once you're in the red, it’s hard to get back to zero.

How to test DNS records manually before sending inbound emails

You can avoid 550 5.1.3 errors in AWS SES by validating your DNS records before sending inbound emails. Use command-line tools like dig to confirm MX, SPF, and DMARC records are correct and not conflicting. Check public DNS validators like MxToolbox to verify propagation and catch misconfigurations early. Always wait 10–30 minutes after changes for full DNS propagation.

Step-by-step: Verify DNS records before enabling inbound email flows

1. Run dig MX example.com to confirm your MX record exists and resolves. An inbound email flow will fail if the domain has no valid MX record. This command returns the mail server responsible for accepting emails. If it returns no result or an error, your domain isn’t set up to receive mail.
2. Check SPF and DMARC with dig TXT example.com. SPF ensures only authorized IPs send emails from your domain. DMARC tells receiving servers what to do if SPF or DKIM fails. Look for syntax errors, such as too many include: clauses or incorrect mechanisms. A typo here breaks email delivery.
3. Look for conflicting records, especially multiple SPF records. You can have only one SPF record per domain. Multiple SPF records cause a permerror and block inbound emails. Use dig TXT example.com and merge any SPF data into a single, compliant record. The SPF specification requires strict formatting.
4. Test with a public DNS checker like MxToolbox.com or mxvalidator.com. These tools simulate how major providers see your DNS records. They highlight issues like missing records, syntax errors, or unexpected TTL values. Use them after every DNS change.
5. Wait 10–30 minutes after changes to test. DNS propagation isn’t instant. Even if you update a record, caches across the internet may still show the old value. Test after waiting at least 10 minutes—ideally 30—to avoid false negatives.

Use real tools to spot misconfigurations early

Manual checks catch most issues, but real-world environments vary. Use tools like MxToolbox to simulate real-time validation across different email providers. These tools reveal problems that command-line tools might miss, such as blacklisting or unexpected DMARC policy enforcement.

Once you've confirmed your DNS is correct, set up AWS SES Inbound Mail Flow using a dedicated domain or subdomain. Ensure your configuration includes proper DKIM signing and a verified identity. If you’re managing high-volume or bulk inbound email, consider using a dedicated email verification service like bulk email list cleaning to avoid invalid domains and reduce bounce rates before they reach your inbox pipeline.

Why validating your email list helps prevent 550 5.1.3 errors in inbound campaigns

You get 550 5.1.3 errors in AWS SES inbound mail flow when the recipient domain doesn’t exist, isn’t resolvable, or lacks proper MX records. Invalid domains — especially typo-ridden ones or those with disposable TLDs like .gq or .tk — are the most common culprits. Cleaning your list upfront by verifying domain validity, syntax, and MX records cuts these errors at the source. With 98.9% accuracy, Email List Validation catches these issues before they disrupt your inbound pipeline.

Domains that mislead are the quiet killers of inbound email

Even a single typo in a domain — like “gamil.com” or “hotmai.com” — can trigger a 550 5.1.3 error in AWS SES. These domains often exist only long enough to harvest emails, then vanish. Similarly, free or disposable TLDs (e.g. .tk, .ml, .cf) aren't configured for inbound mail flow and are frequently blocked by mail receivers. When such addresses are sent to your SES inbox, the system can’t route them — and responds with a permanent failure, even if the message itself is valid.

These errors aren’t just technical glitches — they signal poor list hygiene. Every invalid address you accept means another failure that harms your sender reputation over time. AWS SES monitors inbound delivery patterns and may start filtering traffic from sources that consistently send to non-existent domains. That’s why proactive list validation isn’t optional; it’s a delivery necessity.

Validation doesn’t just prevent bounces — it protects your inbound reputation

When you verify email addresses before sending, you're not just filtering out bad syntax or typos. You're verifying that the domain actually exists, has functional MX records, and is capable of receiving mail. Real-time verification tools like the Email List Validation API confirm this by querying DNS records on the fly.

Let’s say you’re running a customer feedback campaign. If half your list has broken domains or fake TLDs, SES logs those as inbound delivery failures. Over time, repeated attempts to deliver to invalid domains can raise flags in AWS’s internal monitoring systems, even if the rest of your traffic is clean.

Using a tool like bulk email list cleaning, you can process thousands of addresses at once, flagging risky domains, catch-all addresses, and invalid syntax in seconds. It’s not about avoiding a single error — it’s about making sure your entire inbound flow behaves as expected from the start.

Think of it this way: if your SES setup is like a well-secured door, invalid domains are people knocking on the wrong building. You’re not just rejecting them — you’re wasting the system’s time. Verification keeps your system focused on real, deliverable emails.

For more on how DNS configuration impacts inbound email, see the RFC 5321 standards for SMTP delivery and MX record resolution from IETF here. And for a deeper look at how sender reputation is shaped by inbound behavior, explore data from organizations like Spamhaus.

How Email List Validation improves inbound email reliability

Validating your email list before sending reduces bounces, filters out invalid addresses, and avoids sender reputation damage — all critical for consistent inbound email delivery. You're not just sending to active accounts; you're filtering out broken ones, role addresses, and disposable domains that will reject mail outright. This upfront cleanup ensures your messages reach real inboxes, improving deliverability and reducing the risk of 550 5.1.3 errors from misconfigured or rejected recipients.

Preemptive Checks That Prevent Inbound Failures

• Checks if a domain has a valid MX record — without one, mail servers can’t route inbound mail, resulting in immediate 550 5.1.3 bounces.
• Flags domains with known abuse patterns or non-existent hosting — these are often blacklisted or have no mail server presence at all.
• Identifies role-based addresses (e.g. admin@, postmaster@, support@) that commonly reject inbound messages by policy, especially in automated flows.
• Removes disposable and temporary email domains — by design, these reject inbound mail and are often associated with spam traps.
• Filters out domains with weak or no DNS records, which are known to trigger rejection during SMTP verification.

Beyond Filtering: Preserving Sender Reputation

Every hard bounce — especially from invalid or non-existent addresses — negatively impacts your sender reputation. ISPs monitor this closely; too many bounces trigger filtering or blacklisting. By catching these issues before sending, you maintain a cleaner sending profile. It’s not just about avoiding 550 5.1.3 errors; it’s about building long-term deliverability. According to RFC 5321, SMTP transaction failures often stem from missing MX records or non-reachable destinations — exactly what list validation prevents.

Use real-time validation to check individual addresses during sign-up or onboarding. Or, clean entire lists in bulk. Both methods reduce your bounce rate significantly. For instance, an email list cleaned with proper DNS checks can see bounces drop by over 60% in practice, leading to more reliable inbound flow and fewer delivery issues.

Let’s say you’re using Amazon SES for inbound email routing. Even if your AWS SES inbound configuration is correct, poor-quality recipients will still produce 550 5.1.3 errors. That’s why you need an upstream filter: validate the list before hitting SES. You can run bulk verification at bulk email list cleaning or integrate validation directly with your signup flow via our real-time verification API.

Best practices for inbound email deliverability with AWS SES

You can avoid the 550 5.1.3 error in AWS SES by verifying domain ownership, using a dedicated domain for inbound mail, monitoring bounce types closely, sending only to valid recipients, and testing deliverability before going live. These steps prevent reputation damage and keep inbound traffic flowing reliably.

Domain and Configuration Setup

• Before enabling inbound mail, verify your domain in AWS SES using DNS TXT records. Without verification, AWS won’t accept inbound emails, leading to immediate 550 5.1.3 rejections.
• Never assume a domain is trusted. Use AWS’s domain verification process to confirm ownership and avoid configuration drift.
• Set up inbound email routing via S3 or Lambda only after verifying the domain. Misconfigured routes without proper DNS setup result in silent drops or bounces.

Delivery and Reputation Management

• Use a dedicated domain for inbound email—never mix inbound with transactional or marketing emails. This keeps your sender reputation isolated and prevents one channel’s failure from affecting another.
• Never send to role-based addresses (e.g., admin@, info@) unless you’re on established sender lists. These addresses are often monitored by spam filters and may be rejected even with valid DNS settings.
• Use deliverability testing tools to simulate inbound delivery before production use. Tools like Mail-Tester or MxToolbox can reveal issues before you face real bounces.
• Monitor bounce types. A 550 5.1.3 error means the recipient address was not found. Flag these immediately—each one indicates a list hygiene issue that degrades sender reputation over time.
• Regularly clean your email list. Invalid or outdated addresses increase bounce rates and reduce inbox placement. Use reliable tools to remove dead addresses before sending.
• For high-volume inbound, consider bulk verification of expected sender domains. Test your domain's reputation with bulk email list cleaning to catch invalid or high-risk addresses early.

How to use AWS SES inbound email with Email List Validation for full visibility

You can prevent 550 5.1.3 errors in AWS SES by validating incoming addresses in real time with Email List Validation’s API, integrating with platforms like Mailchimp or Klaviyo for automated hygiene, running bulk list checks to flag risky addresses, and triggering a re-verification workflow when delivery fails. This gives you full visibility into who can actually receive your emails.

Set up real-time address validation before storage

1. Use the real-time verification API to check every incoming email address as it arrives through AWS SES. This stops invalid, role-based, or disposable addresses from ever reaching your inbox.
2. Validate against DNS records like MX, SPF, and DNSBLs to catch transient issues like greylisting or temporary failures early. This reduces false positives and stops bounce-prone addresses from clogging your system.
3. Only store addresses that return a "valid" or "risky" status. "Risky" means the address may still deliver but carries higher failure risk—ideal for follow-up review.

Automate hygiene across your stack

4. Integrate Email List Validation with Mailchimp, HubSpot, Klaviyo, or SendGrid via their published APIs. Each platform supports webhooks or scheduled syncs that trigger list hygiene when new contacts are added.
5. Run your bulk email lists through bulk email list cleaning before sending. This finds catch-all domains, disposable email addresses, and known spam traps—common culprits behind 550 5.1.3 and other hard bounces.
6. Set up a rule in your inbound processing pipeline: if AWS SES returns a 550 5.1.3 error (meaning the recipient address was rejected), automatically recheck that email using the verification API. This catches addresses that were temporarily undeliverable or misconfigured.
7. If re-verification confirms the issue, flag it for human review or auto-remove. This prevents repeated delivery attempts that hurt sender reputation.

When problems recur, use the in-app AI assistant to analyze logs and flag patterns—like a high number of catch-all domains or frequent role-based addresses (e.g., info@, admin@). These are strong signals of list decay or poor sourcing.

According to RFC 5321, the 550 5.1.3 error means the recipient’s mail server explicitly rejected the address. It’s not a temporary glitch—it’s a permanent refusal. By validating pre-delivery and monitoring post-failures, you avoid this fate altogether.

Many teams see 40–50% of their bounce rates come from invalid or role-based addresses. With Email List Validation, you catch those early and maintain consistent deliverability on AWS SES.

Conclusion: Fixing 550 5.1.3 starts with valid DNS and clean data

The 550 5.1.3 error is a hard bounce rooted in DNS misconfiguration. It’s not a temporary issue — it means the receiving server refuses the email based on invalid or missing DNS records.

Fixing it requires two things: proper DNS setup for inbound email in AWS SES and a clean email list free of invalid or non-existent domains. Relying on one without the other leaves gaps in deliverability.

When you combine AWS SES’s inbound infrastructure with proactive email validation, you reduce delivery failures before they happen. With 98.9% accuracy, Email List Validation identifies invalid domains before they trigger errors like 550 5.1.3.

Keep reading

• Bounce management: hard bounces, soft bounces and bounce rate (complete guide)
• Automated Detection of 4.7.0 Server Throttling via Envelope Metadata
• Postmark 554 5.1.1 Error Mapping to Hard Bounce in Email Deliverability Dashboards
• Automated 550 5.7.1 Classification Engine for High-Volume Platforms 2024
• How to Validate Sender Reputation to Avoid 451 4.5.2 Delay

Ready to put this into practice? Email List Validation verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

What does 550 5.1.3 mean when receiving email via AWS SES?

It means the recipient’s domain lacks a valid MX record or has blocking DNS policies, causing the mail server to reject the incoming message permanently.

Can AWS SES receive inbound emails from any domain?

Only domains with a valid MX record and compatible SPF/DKIM/DMARC policies can successfully deliver inbound mail to AWS SES.

How do I check if a domain has a valid MX record?

Use the command line: `dig MX example.com` or test via public DNS tools like MxToolbox.com.

Does a catch-all email cause 550 5.1.3 errors?

Not directly. But catch-all domains often route mail to non-functional inboxes, which may result in hard bounces or rejection.

Why do some domains bounce with 550 5.1.3 even when the DNS looks correct?

Because DMARC or SPF policies may block messages from unlisted sources, even if the MX record exists.

How does email verification prevent 550 5.1.3 errors?

By filtering out domains with no MX records, typo-ridden names, disposable TLDs, or known delivery issues before sending.

Is it necessary to validate domains for inbound email?

Yes — validating domains helps ensure you're not sending to addresses on non-receiving systems or fake domains.

Can I use an email verification tool with AWS SES?

Yes — tools like Email List Validation can clean your list before sending, reducing bounce rates and protecting sender reputation.

What is the accuracy of Email List Validation for detecting bad domains?

It identifies invalid or risky domains with 98.9% accuracy using real-time checks and DNS validation.

Do purchased credits in Email List Validation expire?

No — purchased credits never expire, allowing you to use them at your own pace.

What domains are considered disposable and should be removed?

Domains like .tempmail, .gq, .tk, .mailinator, and others known for temporary email services are blocked by Email List Validation.

How can I integrate Email List Validation with my existing email platform?

It integrates natively with Mailchimp, HubSpot, Klaviyo, and SendGrid, and offers a real-time API for custom workflows.