Fix 550 5.7.1 in Amazon SES | Email List Validation

Why does Amazon SES reject emails with 550 5.7.1 sender not authorized?

You sent an email from your domain through Amazon SES, and it bounced with a 550 5.7.1 error: "sender not authorized." You’re sure the address exists. You’re sure the content is safe. So why did Amazon block it?

The answer is in your DNS records. Amazon SES checks your domain’s SPF, DKIM, and DMARC configurations before accepting any mail. If they’re missing, wrong, or conflicting, your domain is not trusted — even if the email address itself is valid.

Think of DNS records like a digital ID badge. If the badge is missing, expired, or doesn’t match your credentials, the system won’t let you through the door. That’s exactly what happens when Amazon SES sees a misconfigured or absent sender identity.

Key takeaways

Amazon SES blocks emails when your domain’s DNS records don’t authorize your sender identity through SPF, DKIM, or DMARC.
Even valid email addresses fail if the underlying DNS authentication is missing or misconfigured.
Fixing 550 5.7.1 requires verifying and correcting your domain’s SPF, DKIM, and DMARC records — not just the email address.

What DNS records must be set for Amazon SES to authorize your domain?

You must configure three DNS records to authorize your domain in Amazon SES: SPF to list amazonses.com as an allowed sender, DKIM to publish a public key for message signing, and DMARC to monitor and enforce authentication policies. Without these, your emails will be rejected with a 550 5.7.1 error. Setting them correctly is required, not optional.

SPF: Authorize Amazon SES as a valid sender

SPF ensures that only authorized servers can send emails on your domain’s behalf. For Amazon SES, you must include include:amazonses.com in your domain’s SPF record. This tells receiving mail servers: “Yes, Amazon SES is allowed to send from this domain.” If it’s missing or misconfigured, Amazon SES will reject outbound messages.

SPF has strict limits—only one SPF record per domain, and it cannot exceed 10 DNS lookups. If you use other services, combine them safely using the include: directive. A misconfigured SPF record is a common cause of 550 5.7.1 errors, so testing before sending is essential. For further details, refer to RFC 7208.

DKIM: Verify message authenticity with digital signatures

DKIM adds a cryptographic signature to each outgoing email. Amazon SES provides a public key that you publish as a TXT record in your domain’s DNS. Receiving servers use this to verify the message wasn’t altered in transit.

The DKIM record should be set at a selector-specific subdomain, like selector1._domainkey.yourdomain.com. The record is generated by Amazon SES and must be copied exactly. If the public key isn’t published, emails may fail authentication checks, especially with strict providers like Gmail or Outlook. The full process is documented in RFC 6376.

DMARC: Monitor, report, and enforce policies

DMARC is optional but highly recommended. It tells receiving servers what to do if SPF or DKIM fails—either quarantine the email, reject it, or allow it. You can also receive reports about authentication results.

Set your DMARC record to v=DMARC1; p=none; initially to monitor without blocking. Later, move to p=quarantine or p=reject as needed. While not required for Amazon SES to deliver, DMARC gives you visibility into sending issues and protects against spoofing. Many enterprise mail systems require DMARC to prevent spoofing.

Use tools that validate DNS records and detect misconfigurations before sending. For example, check your records with MxToolbox or DNSChecker.org. If you're unsure whether your list includes valid, deliverable addresses, clean it first with a reliable verification solution. Clean your list with bulk email verification to ensure high deliverability and sender reputation.

How to check if your DNS records are correctly set for Amazon SES

You can verify your Amazon SES DNS configuration by checking your domain’s SPF and DKIM records using tools like MXToolbox or the command-line dig utility. Ensure the SPF record includes include:amazonses.com, the DKIM record uses the correct selector (like default._domainkey.yourdomain.com), and that no TXT record exceeds 255 characters or your domain hits the 10-record limit. These steps resolve the 550 5.7.1 Sender not authorized error in most cases.

Check your SPF record

Use MXToolbox or run dig txt yourdomain.com to view your domain's TXT records.
Look for a record starting with v=spf1 and confirm it includes include:amazonses.com.
If the record is missing this include, add it—this is the most common fix for the 550 5.7.1 error.
Make sure no conflicting SPF records exist; only one SPF record per domain is allowed.

Verify your DKIM record

Find the DKIM selector used by Amazon SES—typically default—and check for a TXT record at selector._domainkey.yourdomain.com.
Use RFC 6376 as a reference for DKIM verification standards.
Ensure the record contains the full public key in the correct format, with no truncation or formatting errors.
Verify the domain key is published under the right selector; mismatched selectors cause authentication failures even if the key itself is correct.

Check TXT record limits

Domains are limited to 10 TXT records. Too many can cause DNS resolution failures.
DNS TXT records cannot exceed 255 characters. Long records (like complex SPF or DKIM) must be split into multiple parts.
If you have a long SPF record, consider using a DNS provider that supports SPF flattening or use a dedicated SPF service.
You can verify record length using tools like MXToolbox or dig with the txt flag.

Fixing DNS records is not just about adding the right entries—it’s making sure they’re complete, correctly formatted, and within technical limits. A single typo or record limit hit can block all outbound emails. If you’re managing a large list, you may also want to validate the addresses you're sending to before deployment.

The exact steps to fix 550 5.7.1 by configuring DNS records

When Amazon SES rejects your email with a 550 5.7.1 error, it means your domain isn’t properly authorized. You must verify ownership by adding SPF and DKIM records to your domain’s DNS configuration. Amazon SES checks these records before allowing sends, so skipping any step breaks authorization. Once you’ve added both records and waited for propagation, return to the console to complete verification.

Log in to the Amazon SES console and navigate to the Domains section. Select Verify a New Domain and enter your domain name. Amazon will generate specific DNS records for SPF and DKIM verification.
Copy the SPF and DKIM TXT records provided by Amazon. The SPF record starts with v=spf1 include:amazonses.com. The DKIM record includes a selector (like default._domainkey) and a long key value. Don't edit or shorten these values.
Go to your domain’s DNS provider—Cloudflare, GoDaddy, AWS Route 53, or another. Access the DNS management interface for your domain, where you can add custom records.
Create a new TXT record. Set the name field to @ or your full domain (e.g., example.com) to apply to the root. Paste the SPF record exactly as provided. This tells receiving servers which mail servers are allowed to send on your behalf.
Create a second TXT record. Set the name field to match the selector (e.g., default._domainkey). Paste the DKIM key value as a single string. This enables cryptographic signing of your emails, which confirms authenticity.
Save the records. DNS changes can take up to 48 hours to propagate globally, though many providers update within 24 hours. Some servers check DNS more frequently, so patience is required.
Return to the Amazon SES console and click Verify again on the domain. The system will query DNS to validate both records. If correct, your domain status changes to “Verified,” and you can start sending from that domain.

The 7 steps described in “The exact steps to fix 550 5.7.1 by configuring DNS records”, in order.

Why DNS configuration fixes 550 5.7.1

This error occurs because Amazon SES cannot verify your domain's identity. Without properly configured SPF and DKIM records, receiving mail servers reject your messages to reduce spam and phishing. RFC 7483 outlines how SPF authorizes senders, and DKIM validates message integrity. Both are required to establish trust.

Common pitfalls to avoid

Don’t combine multiple SPF records—only one is allowed per domain. If you have existing records, include include:amazonses.com in the existing one. Also avoid adding extra spaces or quotes in TXT values. Use tools like MXToolbox to validate your DNS setup before testing sends.

Once verified, your deliverability improves. If you still see bounces, check for spam traps or invalid addresses in your list. For high-volume senders, clean your list before sending. Clean your email list at scale using real-time validation to maintain sender reputation and inbox placement.

Common DNS mistakes that cause 550 5.7.1 errors

You’re getting a 550 5.7.1 error in Amazon SES because your domain’s DNS records aren’t set up correctly. The most common issues are duplicate SPF records, typos in DKIM selectors, malformed includes, overly long TXT records, or not waiting long enough after changes. Fixing these usually resolves the error immediately.

SPF and DKIM Configuration Errors

Having multiple SPF records is a hard rule violation — only one SPF TXT record per domain is allowed. If you have more than one, merge them into a single record using v=spf1 and list all mechanisms in sequence.
Double-check the include directive for Amazon SES — it must be include:amazonses.com, not include:amazonses.com. A typo here breaks validation and triggers the 550 5.7.1 error.
Verify the DKIM selector (e.g., s1._domainkey) and ensure the public key in the TXT record matches exactly what Amazon SES provided. A single character mismatch invalidates the signature.
DKIM TXT records longer than 255 characters must be split into multiple quoted strings. Example: "v=DKIM1; k=rsa; p=..." — each part must be within 255 characters and quoted separately.

Timing and Verification Delays

After updating DNS records, wait at least 10 to 30 minutes before testing. Some DNS providers propagate faster than others, but delays beyond 60 minutes are uncommon — check your record with tools like MXToolbox or Google Public DNS to confirm visibility.
A common mistake is assuming immediate success. Amazon SES checks DNS in real time, but if the record isn’t fully propagated, the send will fail with a 550 5.7.1 error.

Using DNS records correctly isn't just about formatting — it’s about consistency and timing. Small errors in syntax, placement, or propagation time cause the exact rejection you're seeing.

Before sending high-volume campaigns, validate your setup with tools that check SPF, DKIM, and DMARC records in real time. You can test your domain’s readiness with inbox placement testing to simulate real delivery behavior across major providers.

Why SPF and DKIM alone aren’t enough — and when DMARC helps

You can have perfect SPF and DKIM records, yet still get 550 5.7.1 errors in Amazon SES if your domain is being impersonated. SPF validates the sending IP, DKIM confirms message integrity, but neither stops someone from using your domain in a phishing email. Only DMARC tells receiving servers what to do when a message fails those checks — and that’s how you stop unauthorized senders from hijacking your reputation.

What SPF and DKIM actually do (and don’t do)

SPF checks if the sending IP is listed in your domain’s DNS records. DKIM signs the message body and headers, so the recipient can verify it wasn’t altered in transit. Both are necessary, but neither knows what to do if an email claims to come from your domain but doesn’t pass either test.

Let’s say a bad actor sends an email from a different IP that’s not in your SPF list. SPF will fail. But unless the recipient’s server has DMARC, it won’t know whether to block, quarantine, or deliver that message. Without DMARC, you’re relying on individual ISPs to make their own decisions — and most will deliver it anyway.

How DMARC closes the gap

DMARC doesn’t authenticate the sender directly. It tells receiving servers what to do when SPF or DKIM fails — and it checks alignment between the "from" domain and the domain in the SPF or DKIM signature.

A policy like p=none does nothing to block messages, but it generates reports showing which sends are failing. It’s useful during setup: you can see which IPs, domains, or systems are misconfigured without breaking mail flow.

But if you switch to p=quarantine or p=reject, you’re telling servers to treat unauthorized messages as spam or discard them outright. You can only do that safely once SPF and DKIM are properly aligned across all your sending sources — including any third-party tools like SendGrid or Mailchimp.

As the DMARC specification states, “The policy applies only when both authentication methods (SPF and DKIM) are aligned.” That alignment is critical. You can’t enforce rejection unless every authorized sender passes both checks — and knows your domain. Otherwise, you risk blocking legitimate mail.

Use real-time verification tools to validate your senders’ setups before adding them to your SPF list. Tools like the Email List Validation API can help spot issues in your sending infrastructure before they trigger errors in Amazon SES.

How to test your domain before sending emails with Amazon SES

You should verify your domain in Amazon SES first, then send test emails to known inboxes and review delivery logs in the AWS console. Check spam scores and header alignment with tools like Mail-Tester or GlockApps, and confirm all three authentication records—SPF, DKIM, and DMARC—pass validation. This minimizes the risk of 550 5.7.1 errors and ensures your messages land in the inbox, not the spam folder.

Verify your domain and validate DNS records

Use Amazon SES’s built-in domain verification tool to confirm ownership of your domain. This requires adding a CNAME record to your DNS zone.
After adding the CNAME, wait 5–10 minutes for propagation, then verify the record through the AWS console.
Check that SPF, DKIM, and DMARC records are correctly set in your DNS. Misconfigured or missing records commonly trigger 550 5.7.1 errors.
Use MXToolbox to test your DNS records in real time and identify misalignments before sending.

Test deliverability and check header alignment

Send test emails to real, known addresses (like Gmail, Outlook, Yahoo) and monitor delivery status in the AWS SES console.
Use Mail-Tester.com to assess your message’s spam score and get a real-time breakdown of header issues, including SPF/DKIM alignment.
Check the full email headers in your inbox to confirm that DKIM signatures are valid and SPF passes with your sending IP or domain.
Run the same email through GlockApps.com to detect potential spam triggers or formatting warnings.
Ensure DMARC is set to either monitor or enforce (p=none, p=quarantine, or p=reject). An enforced policy strengthens trust but requires careful setup.
If any of the three records fail validation, go back to your DNS provider and recheck the syntax and record type.

These steps are a standard best practice in email deliverability. A properly authenticated domain reduces the chance of rejection, even when sending to high-security providers like Microsoft or Yahoo.

For ongoing list hygiene, use bulk email list cleaning to eliminate invalid, disposable, and role-based addresses before sending. This reduces bounce rates and protects sender reputation—key factors in avoiding 550 5.7.1 errors.

What happens if you send from a domain with no DNS authentication?

You’ll get a 550 5.7.1 “sender not authorized” error from Amazon SES, and most receiving servers will block your emails or send them straight to spam. Without SPF, DKIM, or DMARC, your domain is unverifiable—receiving systems see it as high risk, regardless of list quality or message content. This isn’t a temporary hurdle; it’s a hard technical barrier that prevents delivery entirely.

Amazon SES enforces authentication

Amazon SES uses DNS records like SPF and DKIM to verify that a domain authorizes a sender. If those records are missing or misconfigured, SES treats the request as a potential spoofing attempt. The 550 5.7.1 error is clear: the sender isn’t authorized to use that domain. Even if your list is perfectly clean, SES will reject the message before it reaches any inbox.

Reputation damage compounds

Even if you bypass SES temporarily—say, by sending through a third-party service without proper authentication—receiving servers will still see your domain as untrusted. According to research from the Messaging, Malware, and Mobile Anti-Abuse Working Group (M3AAWG), unauthenticated domains are significantly more likely to be flagged as spam or blocked outright.

Consistent sending from an unauthenticated domain degrades your sender reputation over time. It’s not just about one bounce—it’s about the cumulative signal that you’re not following email delivery standards. Even with excellent content and strong list hygiene, your deliverability will remain low because technical gatekeeping won’t care about your brand’s copy.

How to fix this properly

Let’s be clear: no amount of tweaking your subject line or cleaning your list will fix a 550 5.7.1 error. The problem isn’t your message or your audience—it’s that your domain doesn’t prove it can send safely. You need to set up SPF to authorize sending IPs, DKIM to sign messages cryptographically, and DMARC to control how receivers handle failures.

Before sending a single email through SES, verify your DNS records match the authentication requirements. Use tools like MxToolbox or RFC 7208 to check your SPF records. If you’re managing multiple domains or large lists, consider validating every email address to catch invalid or misconfigured domains early—our bulk verification service helps with that: clean your list before you send.

How Email List Validation helps avoid sender auth errors before they happen

You can prevent 550 5.7.1 sender not authorized errors in Amazon SES by catching invalid, high-risk, or unverifiable email addresses before they’re even sent. Email List Validation checks deliverability at the address level — filtering out syntactically broken, disposable, or role-based emails, which reduces failed deliveries and protects your sender reputation. Each bounce, especially due to authentication mismatches, harms your standing with ESPs, including AWS. By verifying your list upfront, you reduce the chance of triggering sender auth warnings before they occur.

Prevent bad addresses from ever reaching Amazon SES

When you send to thousands of emails, even a small percentage of invalid addresses can cause problems. Email List Validation checks for syntax errors, domain existence, and whether an email is a role address (like admin@ or support@) or from a disposable domain — common sources of 550 5.7.1 errors. These types of addresses often fail SPF, DKIM, or DMARC checks because they’re not associated with validated sender identities. Removing them before sending avoids the root cause of many authentication failures in Amazon SES.

Using the bulk verification tool — available at bulk email list cleaning — you can process thousands of addresses in minutes, separating valid senders from those that will never deliver. This reduces bounce rates, which directly impacts sender reputation. A healthy bounce rate is key to maintain trust with providers like AWS, where prolonged low-quality sends can trigger throttling or blocking, even with correct DNS configurations.

Real-time validation and inbox placement testing catch issues early

Even with a clean list, new signups or user data can slip in invalid or risky addresses. The real-time verification API — hosted at real-time email verification API — checks each address at the moment of entry. This prevents role-based, catch-all, or temporary emails from ever being added to your send queue, reducing the chance of a 550 error during delivery.

More importantly, inbox placement testing helps you see how your emails are being treated by real email providers. If your message lands in junk folders, it’s often a sign that authentication is weak or the sender reputation is compromised. Testing with Email List Validation’s inbox placement tool — visit inbox placement to learn more — reveals how your emails are actually being received, helping you proactively diagnose delivery issues caused by poor sender authentication or reputation signals.

While DNS records like SPF, DKIM, and DMARC are essential, they aren’t the only factor in email deliverability. As RFC 7673 states, authentication is one of several trust signals a receiving server evaluates. You can’t control how other systems interpret your email, but you can control what gets sent. Filtering out addresses that will never deliver — and verifying sender identity through clean data — is a more reliable foundation than relying solely on DNS records. It’s a practical, technical layer of defense against sender auth errors. You can start with 100 free credits at pricing to test how it works with your current list.

Why verification must come before DNS setup — not after

Setting up DNS records in Amazon SES without pre-verified email addresses is like locking a door before checking if anyone’s home. Even with perfect SPF, DKIM, and DMARC, sending to invalid, catch-all, or disposable addresses raises bounce rates, triggers spam filters, and harms sender reputation. You can’t fix deliverability at scale if your list still contains dead or risky addresses. The fix starts with cleaning your list first, not with authentication.

Why DNS alone won’t save a poor-quality list

Even if your domain is authenticated correctly, Amazon SES will reject messages to invalid or non-existent addresses with a 550 5.7.1 error—regardless of DNS setup.
Catch-all domains (e.g., [email protected]) accept all incoming mail but often result in high bounce rates and low engagement, hurting your sender reputation.
Disposable email addresses (e.g., [email protected]) are created for temporary use and are never opened—sending to them counts as low-quality volume and increases spam complaints.
Role accounts like admin@, info@, or sales@ are not personal inboxes and may not be monitored; sending to them rarely converts and can trigger feedback loops.

Pre-verification is your deliverability foundation

Use a real-time email verification API or bulk validation tool to catch invalid, risky, and disposable addresses before you ever send.
Verify every address in your list—before you configure DNS, before you send a test campaign, before you scale.
With tools like Email List Validation, you can eliminate up to 30% of invalid addresses in a typical list, significantly reducing bounces and improving inbox placement.
Only after cleaning your list should you focus on domain-level authentication. DNS records (SPF, DKIM, DMARC) are effective only when the sending domain is trusted and the list is clean.
For large or ongoing campaigns, integrate validation into your workflow using the real-time verification API or bulk verification service.

Deliverability isn’t about just setting DNS records—it’s about sending only to addresses that will actually receive and engage with your email. That starts with verification.

For a deeper look at how email validation impacts sender reputation and inbox placement, refer to industry standards and best practices published by RFC 5321 and Spamhaus, both of which emphasize the importance of list hygiene in maintaining email trust.

Final takeaway: Correct DNS records fix the 550 5.7.1 error — but clean lists ensure long-term success

The 550 5.7.1 error in Amazon SES is a technical signal: your sender is not authorized because SPF, DKIM, or DMARC are misconfigured or missing. Fixing those DNS records resolves the immediate block.

But resolving one error doesn’t guarantee inbox placement. Over time, sending to invalid, outdated, or abusive addresses harms your sender reputation—and leads to throttling, filtering, or blacklisting.

Two pillars of deliverability

Correct DNS configuration (SPF, DKIM, DMARC) ensures authentication passes.
Clean email lists ensure you're only sending to valid, engaged recipients.

When both are in place, you avoid bounces, maintain sender reputation, and maximize inbox placement.

Keep reading

Ready to put this into practice? Email List Validation verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

How long does it take for DNS changes to fix 550 5.7.1 in Amazon SES?

DNS changes typically take 24 to 48 hours to propagate. In some cases, updates occur within minutes if your DNS provider uses low TTLs.

Can I use multiple domains with Amazon SES?

Yes, but each domain must be verified and properly authenticated via DNS records before sending from it.

What’s the difference between SPF and DKIM in Amazon SES?

SPF checks the sending IP address against a list in your DNS. DKIM signs the email content using a private key and verifies it with a public key in DNS.

Does Email List Validation check DNS records?

No — it checks email address validity, deliverability, and risk factors. It does not validate DNS records for AWS or other domains.

Why does my email get blocked even with correct DNS records?

Other factors can block delivery: sender reputation, high bounce rates, content triggers, or the recipient’s spam filters.

Can I send emails with Amazon SES from a subdomain?

Yes, but the subdomain must be verified separately, and its DNS records must include the proper SPF and DKIM settings.

Is DMARC required to send with Amazon SES?

No — SPF and DKIM are sufficient. DMARC is recommended for monitoring and security but not mandatory.

How many emails can I send with Amazon SES without warming up?

Amazon SES requires sending volume growth over time. Starting at 100 messages per day and scaling up helps avoid rate limits and spam complaints.

What does ‘catch-all’ mean in Email List Validation?

A catch-all address accepts any email, even if the user doesn’t exist — often used by spammers. Such addresses are high-risk and should be removed from your list.

How accurate is Email List Validation’s verification process?

Email List Validation achieves 98.9% accuracy in distinguishing valid, invalid, catch-all, and risky email addresses.

Are purchased credits in Email List Validation permanent?

Yes — credits never expire, allowing you to manage verification costs over time.

How does Email List Validation integrate with Mailchimp or SendGrid?

It syncs with Mailchimp, HubSpot, Klaviyo, and SendGrid to automatically verify addresses before sending, reducing bounces and improving deliverability.