What DNS Settings Cause AWS SES DSN 5.4.3 Errors in 2026

Why does AWS SES return DSN 5.4.3 at all?

You sent a message through AWS SES. It looked correct. The logs say “5.4.3.” You check again. Same result. Why?

DSN 5.4.3 isn’t a glitch. It’s a firm “no.” The receiving server rejected your message permanently—no retry will help. The issue isn’t on your side alone; it’s rooted in DNS or network settings the recipient controls. Understanding which ones matters because fixing them means fewer bounced messages and better sender reputation.

What DNS or network settings affect AWS SES DSN 5.4.3 errors? They’re not hidden. They’re fundamental: SPF, DKIM, DMARC, reverse DNS, and sender reputation—all must align. A misconfiguration here stops delivery before it starts.

Key takeaways

• DSN 5.4.3 indicates a permanent rejection by the recipient’s mail server due to policy or configuration issues.
• Common root causes include missing or misconfigured SPF/DKIM records, failed reverse DNS, or sender reputation blocks.
• Even with correct SES setup, errors can stem from recipient-side DNS or network policies, not AWS SES itself.

How do DNS settings affect AWS SES deliverability?

Incorrect or missing DNS records like SPF, DKIM, and DMARC are the most common cause of AWS SES DSN 5.4.3 errors. Receiving servers check these records to verify your domain’s authenticity. If alignment fails—due to misconfigured SPF, missing DKIM signatures, or overly strict DMARC policies—your emails get rejected even if they’re technically valid. This isn’t about AWS SES itself; it’s about whether the receiving server trusts your domain’s sender identity.

SPF: Your domain’s sender identity

SPF (Sender Policy Framework) tells mail servers which IPs are authorized to send mail on your domain’s behalf. If your SPF record is missing, malformed, or doesn’t include AWS SES’s sending IP ranges, receiving servers may flag your messages as suspicious. A single syntax error—like an invalid mechanism or exceeding the 10 DNS lookup limit—can trigger a DSN 5.4.3. Let’s say you’ve configured SPF but forgot to include aws.amazon.com. Even if your email is sent via SES, the recipient’s server sees no valid policy and rejects it.

DKIM: Proving your email wasn’t tampered with

DKIM signs your email with a cryptographic key tied to your domain. The signature must align with the domain in the From header. If you send from [email protected] but DKIM signs with mail.yourdomain.com, the match fails. Even a minor key mismatch—like using the wrong selector—breaks validation. AWS SES handles this automatically if you set it up correctly, but if you’ve changed DNS records or the key, alignment breaks. Misconfigured DKIM is a frequent silent cause of bouncebacks.

DMARC: Your enforcement policy

DMARC uses SPF and DKIM results to decide what to do with messages that fail validation. If you set a strict policy like policy=reject but SPF fails due to a missing or incorrect record, your email gets blocked even if DKIM passes. Overly aggressive DMARC policies—especially with fo=1—can reject emails that partially align. Some large providers use DMARC enforcement to block unaligned messages. Without checking the DMARC record via tools like dmarc.org or MxToolbox, you might not realize you’ve locked out your own sends.

Preventing DSN 5.4.3 errors starts with ensuring your DNS records are not just present but actively aligned, correct, and verified. Use tools like bulk email list cleaning to identify and fix problematic domains or senders before sending. That way, you’re not just sending from AWS SES—you’re sending from a domain that’s recognized as trustworthy.

What specific DNS records must be correct for AWS SES?

You need three core DNS records for AWS SES to work properly: a TXT record for SPF that includes include:amazonses.com, at least one DKIM TXT record at a subdomain like selector._domainkey.yourdomain.com with a public key, and a DMARC TXT record at _dmarc.yourdomain.com with a policy like rua=mailto:[email protected]. MX records aren't required, but conflicting ones can hurt deliverability. Use tools like MXToolbox to validate your setup.

SPF: Authorize AWS SES in your sending policy

• Include include:amazonses.com in your SPF record to authorize AWS SES as a valid sender.
• Do not rely solely on IP address lists — AWS SES uses dynamic IPs, so include:amazonses.com is the correct, permanent method.
• Ensure no conflicting policies exist; SPF failures cause immediate DSN 5.4.3 errors.

DKIM & DMARC: Verify authenticity and enforce policies

• Set up one or more DKIM TXT records at subdomains like selector._domainkey.yourdomain.com, using the keys AWS SES provides.
• Your domain must have at least two DKIM keys to enable email signing redundancy and improve fallback reliability.
• Configure DMARC with a policy of none (monitoring), quarantine (soft reject), or reject (strict enforcement), and point reporting emails to a valid address.
• Even if misconfigured, incorrect or conflicting MX records can weaken trust with receiving servers and hurt inbox placement—especially if they conflict with your DKIM/SPF setup.

Let’s be clear: DNS errors are among the top reasons for DSN 5.4.3 in AWS SES. Even a small typo in a TXT record can block delivery. SPF itself requires strict formatting; one misplaced space or quote breaks the entire policy.

Always validate your DNS entries using a real-time tool like DMARCian’s checker or MXToolbox before sending. If your email list includes invalid or risky addresses, you can inflate sender reputation risk. Clean your list first—use bulk email list cleaning to identify and remove problem addresses before sending through SES.

Can network-level configuration cause DSN 5.4.3 errors with AWS SES?

Yes—network-level restrictions on your sender IP or the AWS SES outbound path can trigger DSN 5.4.3 errors. If your VPC, firewall, or security gateway blocks SMTP traffic on ports 25, 587, or 465, or intercepts messages from AWS SES’s shared IP pool, delivery fails even if your message is valid. Some corporate networks actively block outbound traffic from known cloud providers unless explicitly allowed.

Outbound SMTP ports and network policies

AWS SES uses standard SMTP ports—25, 587, and 465—to deliver messages. If your network blocks these ports, outbound email gets dropped before it reaches the intended destination. This failure appears to the sending server as a permanent rejection, often coded as DSN 5.4.3. You might see this when using an on-premises email gateway, a custom VPC configuration, or a third-party web application firewall (WAF).

Corporate firewalls and cloud security gateways sometimes block traffic from AWS IP ranges. These systems may flag AWS SES due to its use of shared IPs across many customers. If the current IP has been flagged for spam activity—even if not by your account—rejection can occur regardless of your sender reputation. RFC 5321 defines how SMTP servers handle rejection codes, including 5.4.3, which signals a policy or administrative issue on the receiving side, not a recipient error.

Shared IPs, blocklists, and sender reputation

AWS SES operates on a shared IP pool. A single sender’s abuse can cause the entire pool to be temporarily blocked by some receivers. While AWS manages this through reputation monitoring, a few bad actors can still affect legitimate senders. When that happens, messages may be rejected with a 5.4.3 error due to policy blocking—especially if the IP is listed on a real-time blocklist.

You can't control which IP AWS uses, but you can reduce risk. Clean your sender list before sending—invalid or compromised addresses increase the chances of spam detection. Use tools like bulk email list cleaning to catch invalid, disposable, or high-risk addresses before they hit AWS SES. This helps maintain sender reputation and improves inbox placement over time.

How does AWS SES handle sender reputation and IP allocation?

AWS SES uses a shared IP pool where each IP is monitored for abuse, bounce rates, and spam complaints. If an IP exceeds thresholds—like high hard bounces or spam complaints—it can be throttled or blacklisted. New senders must go through a warm-up phase; sending too much too soon risks triggering DSN 5.4.3 errors due to poor sender reputation. High bounce rates from invalid or unverified addresses directly increase the risk of IP-level blocking.

Shared IPs and Reputation Monitoring

You don’t control your IP in AWS SES. All outbound emails share a pool of IPs managed by AWS. Each IP is tracked for behavioral signals like delivery rates, hard bounces, and user complaints. If the aggregate behavior of any IP crosses thresholds, AWS may throttle or block it to protect the overall deliverability of the pool. That means your sending behavior affects not just your own messages, but others using the same infrastructure.

Spam traps, high complaint rates, or consistent hard bounces are red flags. Services like Spamhaus and MxToolbox track these patterns. When an IP appears on a blocklist, even legitimate emails may fail. You can’t directly influence this unless you manage the list quality behind your sends.

Warm-up and Sending Behavior

When you start using AWS SES, you're in a warm-up phase. Early high-volume sends without a history of engagement can trigger DSN 5.4.3 errors, even if your content is clear and compliant. AWS limits your sending speed and volume as you build credibility. The system expects you to gradually increase volume over time to demonstrate reliability.

Let’s be clear: sending to unverified or invalid addresses defeats the purpose of warm-up. High bounce rates—especially hard bounces—signal poor list hygiene. This harms your reputation fast. If you’re using a list with outdated or fake emails, you’re more likely to hit hard bounces, which directly cause throttling or IP blacklisting.

Fix that with real-time list validation. You can prevent invalid addresses from ever getting into your AWS SES queue. Check list health upfront with bulk verification before sending to AWS SES.

What DNS or network settings affect AWS SES DSN 5.4.3 errors?

DSN 5.4.3 errors in AWS SES typically stem from authentication or network misconfigurations: missing or invalid SPF, DKIM, or DMARC records, sending from unverified domains, or blocked SMTP ports. These issues are often rooted in DNS setup, sender reputation, or outbound firewall rules.

DNS Authentication Misconfigurations

Let’s break down the core DNS and network causes of 5.4.3 errors, starting with email authentication.

Network and Reputation Issues

Authentication isn’t the only factor. Outbound network policies and sender reputation matter just as much.

• Blocked or throttled IP: AWS SES uses shared IPs. If your sending volume includes many invalid or stale addresses, bounces can trigger throttling or IP blocklists.
• Firewall or VPC security group blocking SMTP ports: Outbound traffic on port 25 (unencrypted), 587 (TLS), or 465 (SSL) must be allowed. Many firewalls or VPC configurations restrict these by default.

Proactively checking your list for invalid addresses reduces bounce rates. You can validate your entire list before sending with bulk list cleaning to avoid reputation damage.

How to verify DNS settings before sending with AWS SES?

You can prevent DSN 5.4.3 errors by verifying your domain in AWS SES, ensuring SPF, DKIM, and DMARC records are correctly published in your DNS provider, confirming propagation with tools like MXToolbox or dig, sending a low-volume test email, and monitoring sending statistics for bounces and complaints. These steps catch issues before they impact deliverability.

Confirm Domain Verification in AWS SES

Log into the AWS SES console and navigate to the "Domains" section. Make sure your domain appears with a “Verified” status. If it’s not verified, you must complete the verification process by adding a DNS TXT record to your domain’s DNS zone.

Without this step, AWS SES won’t allow you to send email from that domain, and any outbound messages will fail with a permanent error like 5.4.3 — specifically because the domain isn’t authenticated.

Check DNS Records for SPF, DKIM, and DMARC

1. Verify SPF records exist and include your AWS SES sending IPs or the include:amazonses.com directive. An SPF record must not exceed 10 mechanisms or include too many lookups. Check for syntax errors using a validator like DNSChecker’s SPF checker.
2. Confirm DKIM is enabled in AWS SES and that the three required TXT records (for each DKIM selector) are published in your DNS. DKIM signs each message, proving authenticity. Without it, your emails are more likely to be flagged or rejected.
3. Review your DMARC policy (usually published as a TXT record at _dmarc.yourdomain.com). A DMARC policy with sp=none is a good start; sp=quarantine or sp=reject can improve delivery if properly implemented, but only after monitoring. This helps receivers decide how to handle messages that fail SPF or DKIM.

Verify Propagation and Test Delivery

After adding records, wait 5–15 minutes (sometimes longer) and use tools like MXToolbox or the command-line dig TXT yourdomain.com to confirm the records appear globally. Partial propagation is a common issue — a record visible in one region may not yet be visible in another.

Send a single test email to a personal inbox or a service like Mail-Tester. Review the headers for SPF and DKIM alignment. If they fail, return to your DNS provider and check for typos or incorrect formatting.

Monitor Sending Performance

Once you’re sending regularly, use AWS SES’s built-in sending statistics to track bounce and complaint rates. A steady increase in hard bounces or complaints can signal problems with your list quality or sender reputation. These metrics are a direct indicator of whether your DNS setup is holding up in real-world conditions.

For more proactive quality control, especially when managing large lists, consider running a full email validation pass. Clean your list before sending to reduce bounces and protect your sender reputation.

Why is list hygiene critical for avoiding DSN 5.4.3?

DSN 5.4.3 errors in AWS SES often stem from sending to invalid, disposable, or role-based email addresses—common when your list contains unverified contacts. These bad addresses inflate your bounce rate, trigger SES throttling, and degrade sender reputation. Clean lists with verified, active inboxes reduce bounces and prevent delivery failures.

Bad email addresses hurt your sender reputation

You might not see DSN 5.4.3 immediately, but sending to invalid or disposable emails slowly erodes your sender reputation. AWS SES monitors bounce rates closely; high volumes of permanent or transient failures can lead to throttling or IP-level rejection. Even a small number of invalid emails can skew your sending metrics and push you into restricted sending tiers.

Role-based addresses like admin@, support@, or sales@ frequently don’t accept inbound mail. They're often monitored for spam or configured to reject messages outright. When you send to these, you’re likely to get a hard bounce—and those count as permanent failures, directly harming your reputation. According to RFC 5321, such addresses are not intended to receive user-generated messages.

Disposable domains—created on the fly for registration and then abandoned—are a red flag. They’re commonly used in spam campaigns and blocked by major mailbox providers. Even if an address appears valid on first check, it may be short-lived or outright rejected. Services like Spamhaus track these domains and flag them in real time.

How to stop DSN 5.4.3 at the source

Let’s be honest: no one wants to send to addresses that won’t even receive mail. That’s why list hygiene isn’t a bonus—it’s a necessity. Before you send with AWS SES, validate every address against real-world delivery behavior. Use tools that test reachability, check for role accounts, and flag disposable domains.

For example, an email verification API can catch invalid syntax, test MX records, and simulate SMTP conversation—all in real time. This cuts out the guesswork. You can clean your list before sending, not after. If you’re managing large volumes, bulk verification helps identify dead zones in your list before they cause delivery issues.

Tools like bulk email list cleaning or real-time email verification integrate with platforms like Mailchimp and SendGrid, so you can verify emails at scale. It’s not about perfection—it’s about reducing risk before it impacts your domain reputation.

How to fix DSN 5.4.3 errors with real-time email verification?

DSN 5.4.3 errors often stem from invalid, disposable, or role-based email addresses—many of which are never delivered and harm your sender reputation. You can prevent them by scanning your list with real-time verification before sending, filtering out addresses flagged as invalid, catch-all, or risky, and cleaning data on the fly during signup or campaign sends. Using a high-accuracy tool like Email List Validation reduces bounce rates and improves deliverability.

Step-by-step: Use real-time verification to prevent DSN 5.4.3 errors

1. Scan your list before sending using bulk verification. Run your entire email list through a tool like Email List Validation’s bulk verification to catch invalid, catch-all, or disposable addresses before they trigger DSN 5.4.3 errors. This step stops bad data from ever reaching AWS SES.
2. Check for role-based, disposable, or high-risk domains. Addresses like admin@, support@, or those from known disposable domains often return 5.4.3 when AWS SES tries to deliver. The tool identifies these patterns and flags them as risky, so you can filter them out.
3. Filter out addresses with 'invalid' or 'risky' verdicts. You don’t need to send to addresses marked as invalid. These will fail delivery and hurt your sender reputation. Removing them before sending prevents unnecessary SMTP sessions and reduces bounce rates.
4. Use the real-time verification API during signups or sends. Integrate the real-time verification API into your sign-up form or campaign workflow to clean email addresses on the fly. This prevents bad data from entering your list in the first place.
5. Validate email formats and domains before delivery. Over 98.9% of results from Email List Validation are accurate. This level of precision helps detect malformed addresses or domains that are no longer active, preventing delivery failures that lead to DSN 5.4.3 responses.

Why this works: DNS and network settings aren’t the only issue

While DSN 5.4.3 is often triggered by DNS policies or network-level filtering, many of these errors originate from poor data hygiene. According to RFC 5321, 5.4.3 means “message too large or not accepted,” but in practice, it’s frequently misclassified—especially when the root issue is an invalid or inactive address. The real fix often lies in data quality, not infrastructure.

Let's be clear: SMTP errors like 5.4.3 don’t always mean your DNS settings are wrong. They usually mean your recipient list contains dead ends. Fixing that starts with knowing which emails are valid—before you send.

By integrating proactive verification, you reduce sender load, keep your reputation healthy, and avoid the frustration of recurring delivery errors. This isn’t automation—it’s precision.

Which tools help verify AWS SES delivery readiness?

You can verify AWS SES delivery readiness by cleaning your list before sending. Tools like Email List Validation check for invalid, disposable, or risky addresses, reducing bounce rates and protecting your sender reputation. While no tool fixes DNS misconfigurations like SPF or DKIM issues, pre-send validation catches invalid targets early—cutting delivery failures and improving inbox placement. Let’s look at how the most accurate tools fit into your workflow.

Comparison of List Validation Tools

Each tool has trade-offs. Email List Validation offers the most direct path for AWS SES users with integrations into Mailchimp, HubSpot, Klaviyo, and SendGrid—validating lists before upload. This helps avoid DSN 5.4.3 errors caused by invalid recipients, even when your DNS settings are correct.

What No Tool Can Fix

While validation reduces invalid sends, nothing replaces proper DNS configuration. Misconfigured SPF, DKIM, or DMARC records are common root causes of 5.4.3 errors. These issues must be checked directly in your AWS console or with tools like MxToolbox or RFC 6376 (DKIM).

That said, catching invalid addresses early reduces pressure on your reputation. A clean list minimizes hard bounces—not just the 5.4.3 errors you see in AWS SES logs, but also the risk of being flagged as a spam source. Use bulk verification to test your send list before deploying to the AWS SES API.

Validation doesn’t remove DNS issues, but it does reduce the impact of sending to bad addresses—making your delivery checks more reliable over time.

A final note: DNS issues are not the only cause of DSN 5.4.3

DNS misconfiguration is a common root of DSN 5.4.3 errors, but it’s not the only factor. Misaligned From headers, mismatched Reply-To domains, or expired TLS certificates can also trigger rejection.

Recipient servers evaluate more than just DNS. Messages may be blocked due to content filtering, sender reputation, or regional email policies—especially in domains with strict compliance requirements.

Even with correct DNS, errors persist if the sending infrastructure or content is flagged. Validating your email list proactively and monitoring sender reputation help limit the impact of any single failure.

Keep reading

• List validation integrations with ESPs and CRMs (complete guide)
• Resolving SendGrid 5.6.1 Authentication Issue on Dedicated IP Relay
• Formatting Verified Email Lists for HubSpot CRM Campaigns 2026
• CRM Email Verification with CSV Import and Error Reporting
• Automated Detection of Mailgun 4.7.1 Account Temporarily Unavailable

Ready to put this into practice? Email List Validation verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

What does DSN 5.4.3 mean in AWS SES?

It indicates a permanent delivery failure due to a policy or configuration issue on the recipient side, often caused by DNS misalignment or sender reputation problems.

Can SPF alone prevent DSN 5.4.3 errors?

No—SPF is one part of a larger validation stack. Even with SPF, missing DKIM or an overly strict DMARC can cause rejection.

How long does it take for DNS changes to affect AWS SES?

DNS propagation typically takes 2–5 minutes, but can take up to 24 hours depending on TTL settings and provider caches.

Why does AWS SES mark some senders as risky?

High bounce, complaint, or spam-trap rates reduce sender reputation. AWS SES may throttle or block senders with poor performance history.

Can I use AWS SES without verified domain DNS records?

No—verified domains with correct DNS records (SPF, DKIM, DMARC) are required to send from your domain in AWS SES.

What’s the best way to test if my DNS is set up correctly?

Use tools like MXToolbox to check TXT records, and send test emails through the AWS SES console to verify deliverability.

Does list hygiene affect DSN 5.4.3 errors?

Yes—invalid or disposable emails increase bounce rates, harming sender reputation and increasing the chance of permanent rejection.

Can Email List Validation fix DNS issues?

No—it cannot fix DNS configuration, but it identifies invalid addresses before they cause bounces and damage sender reputation.

How often should I validate my email list with Email List Validation?

At least before every major send, and monthly for ongoing list hygiene. Use the real-time API for live validation during signups.

What happens if I ignore DSN 5.4.3 errors?

Persistent errors harm sender reputation, reduce deliverability, and can lead to AWS SES sending limits or suspension.

Is DMARC required for AWS SES?

No—DMARC is optional. But without it, you lose visibility into alignment failures, and overly strict policies can cause unintended rejections.

Can a firewall block AWS SES messages?

Yes—firewalls that block outbound SMTP on port 25, 587, or 465 can prevent delivery. Ensure those ports are open in your VPC or security groups.