Why Does SMTP 550 Occur When Sending from AWS SES?

You sent a transactional email from AWS SES—no warnings, no delays—and then got back an SMTP 550 error: “Mailbox not found.” You’re not alone. This specific error code appears in almost 30% of failed AWS SES deliveries, often due to a misconfigured SPF record.

Think of SPF like a digital gatekeeper. When you send from AWS SES, the recipient server checks your domain’s SPF record to confirm your sending IP is authorized. If it doesn’t match—or if the record is missing, malformed, or too long—you don’t get past the gate. No access. No delivery. No inbox.

This article explains how an incorrect SPF record triggers SMTP 550 errors in AWS SES, walks through the diagnostic steps you can take right now, and shows exactly how to fix it—without needing to redeploy your infrastructure or wait days for changes to propagate.

Key takeaways

  • SMTP 550 errors in AWS SES are frequently caused by SPF records that don’t authorize Amazon’s sending IP ranges.
  • Even a single mismatched or invalid SPF record can block all outbound mail from your domain.
  • Fixing the SPF record requires checking both the DNS record format and the list of authorized senders, including AWS SES.

What Is SPF and Why Does It Matter for AWS SES?

SPF (Sender Policy Framework) is a DNS record that tells receiving servers which mail servers are authorized to send email on behalf of your domain. If your AWS SES setup isn’t listed in your domain’s SPF record, even perfectly valid emails will be rejected with a 550 mailbox not found error, because the receiving server sees your domain’s email as impersonation. This happens regardless of content quality or recipient legitimacy.

SPF and AWS SES: What You Need to Know

When you use AWS SES, you’re not sending from a shared server—it uses a dedicated IP pool. Your domain’s SPF record must explicitly include this pool to pass authentication. Without it, receiving mail servers interpret your messages as fraudulent, even if you’ve configured everything else correctly.

You might think “I’m not sending from a suspicious IP,” but spam filters don’t care. They rely on SPF, DKIM, and DMARC to verify legitimacy. If SPF fails, delivery fails—even if the email address exists.

Most ISPs and major providers like Gmail, Outlook, and Apple Mail enforce SPF as a baseline. According to the IETF’s official SPF RFC, SPF is the first line of defense against sender spoofing. It’s not optional. Skipping it risks your entire sender reputation.

Let’s say you’ve set up AWS SES correctly, but emails keep bouncing with SMTP 550 errors. The fix isn’t in the message body or the recipient address—it’s in your DNS. If your SPF record doesn’t include include:amazonses.com, you’re blocked by design. A simple update can resolve it.

How to Fix It: Real-World Steps

Start by checking your current SPF record using tools like MXToolbox or by querying DNS directly. Your record must include include:amazonses.com and follow SPF syntax rules. Multiple SPF records are invalid—only one per domain is allowed.

For example, a correct SPF record looks like: v=spf1 include:amazonses.com -all Any deviation can cause failures. Avoid common mistakes like using ip4: records instead of include, or adding duplicates.

Once updated, give DNS time to propagate—this can take up to 48 hours. Test your setup with an email verifier before sending to your full list. Bulk verification can help identify invalid addresses before they trigger bounces, ensuring your sender reputation stays clean.

How to Check if Your SPF Record Is Misconfigured in AWS SES

Run a DNS lookup on your domain using a tool like MxToolbox or dig to retrieve your current SPF record. If it doesn’t include include:amazonses.com, your AWS SES emails will fail with a 550 error. Also check for syntax errors, too many mechanisms, and DNS lookups over the 10-limit cap. Fixing this resolves most mailbox-not-found bounces.

Step-by-Step SPF Validation

  1. Run a DNS lookup on your domain using MxToolbox or the dig command: dig TXT yourdomain.com. This returns all TXT records, including your SPF record. Look for the one starting with v=spf1.
  2. Check for AWS SES inclusion — your SPF record must contain include:amazonses.com. Without it, AWS SES can’t authenticate outbound emails, triggering the 550 error. This ensures emails from your domain are sent within Amazon's trusted infrastructure.
  3. Count DNS lookups — each include, exists, or redirect mechanism counts as a DNS lookup. The SPF specification limits you to 10 lookups. Exceeding this causes soft failures and delivery issues.
  4. Scan for common flaws — typo in include:amazonses.com (e.g., amazonses.com. with a dot) or duplicate mechanisms can break the record. Avoid using all without a proper mechanism at the end. Use include:amazonses.com — not ~all or -all unless explicitly needed.
  5. Use a validation tool — run your full SPF record through RFC 7208’s SPF syntax rules and validate it with a service like MxToolbox’s SPF Analyzer to catch edge cases and compliance issues.

Common Misconfigurations to Watch For

  • Multiple SPF records — only one TXT record should define SPF. Multiple records break DNS validation.
  • Using redirect or exp without care — these also consume DNS lookups and can cause delivery failures if not properly handled.
  • Overloading with third-party inclusions — each external include adds one DNS lookup. Limit to essential providers.

A common cause of persistent 550 errors in AWS SES is a missing or invalid include:amazonses.com directive. Even a single typo can break authentication. Always verify the record in DNS before sending.

Once verified, test delivery by sending a sample email via SES and monitor logs. If errors persist, review the full email headers for authentication failures or check AWS SES’s sending reputation dashboard.

The Correct SPF Record for AWS SES with a Dedicated IP

If you're getting SMTP 550 "mailbox not found" errors when sending via AWS SES with a dedicated IP, the issue is likely a misconfigured SPF record. The correct format is v=spf1 include:amazonses.com -all. This explicitly permits only AWS SES to send mail from your domain, and the -all mechanism rejects all other sources. Using ~all is acceptable during testing but weakens sender authentication.

Why This SPF Record Works

You need only one SPF record per domain, and it must include include:amazonses.com to authorize AWS SES. The v=spf1 tag declares the version. Without this include, your emails are blocked because the receiving server can’t verify your sender identity.

The -all mechanism is critical: it tells receivers to reject messages from any server not listed. This prevents spoofing and strengthens your sender reputation. Using ~all (soft fail) is not recommended for production — it allows unauthorized senders to deliver, which harms your reputation over time.

Common Mistakes to Avoid

Don’t combine multiple SPF records. If you have another sender like Google Workspace, you can merge them using include tags, but only one DNS record should exist for SPF. Too many records or invalid syntax break the validation.

Don’t include your IP address or use ip4: entries unless you’re sending directly from your own server. With AWS SES, the only authorized sender is Amazon’s infrastructure. The include:amazonses.com directive covers all valid IPs.

Test your record using tools like MXToolbox or RFC 7208, which defines SPF syntax and best practices. These tools validate your record’s structure and help avoid errors before they affect deliverability.

If you're managing a large list of emails, verify them before sending. A clean list reduces bounce rates and stops SPF errors from being masked by invalid addresses. Try bulk email verification to catch issues early and improve inbox placement.

How to Update Your SPF Record in AWS SES

You fix the SMTP 550 "mailbox not found" error caused by an incorrect SPF record in AWS SES by enabling SPF authorization in the console. When you set it to Yes, AWS SES automatically generates the correct DNS record with include:amazonses.com, ensuring your emails pass SPF checks. This resolves delivery failures due to missing or invalid sender policy.

  1. Sign in to the AWS Management Console and open Amazon SES in your region.
  2. Go to the Domains section. Select the verified domain you’re using to send emails with SES.
  3. Click Edit to access the domain’s configuration settings.

Enable SPF and Let AWS Handle the DNS Record

  1. Under the SPF setting, choose Yes if you want SES to send emails on behalf of this domain. This enables SPF alignment.
  2. Save the changes. AWS SES now automatically updates the DNS record for your domain with the correct include:amazonses.com directive.
  3. Wait 10–30 minutes for DNS propagation. Confirm the record is active using tools like MXToolbox or the SPF specification (RFC 7208).
  4. If you manage multiple domains, repeat this process for each one used with SES to avoid future delivery issues.

Incorrect SPF records can cause emails to be rejected by recipients, even when the email address exists. By letting AWS handle the DNS record, you eliminate misconfigurations. If you still see errors, check your DKIM signature and ensure all sending domains are verified.

For larger sends, validate your list before sending. Email lists with outdated or invalid addresses increase the chance of SPF-related bounces. Run a bulk verification to clean your list before deployment:

Verify your entire email list in minutes with built-in deliverability analysis.

What Happens After You Fix the SPF Record?

After you update the SPF record in your DNS, it may take 1 to 24 hours for the change to propagate globally — DNS updates don’t apply instantly. Once propagation completes, retry sending your email through AWS SES. If the SPF configuration was the root cause, the SMTP 550 “mailbox not found” error should resolve, and messages will deliver successfully. Monitor your bounce logs and delivery reports to confirm the fix is working across multiple recipient domains.

DNS Propagation and Delivery Testing

Even after fixing your SPF record, don’t assume the problem is solved right away. DNS changes propagate at varying speeds across the internet, depending on TTL settings and recursive resolver caching. It’s common for changes to take up to 24 hours, especially if your TTL is set high. You can check propagation status using tools like MxToolbox or dnschecker.org to verify the new SPF record is visible worldwide.

Once propagation is complete, send a test email from your AWS SES account to a verified address. If the 550 error no longer appears, the fix was effective. You can also query the AWS SES sending metrics in the AWS Console under “Send Statistics” or use the email verification API to pre-check recipient domains for valid configurations before sending.

Monitoring Delivery and Bounce Logs

After the fix, keep an eye on your bounce messages and delivery logs. In AWS SES, bounce and complaint notifications are logged in the Amazon SNS or Amazon CloudWatch. Valid bounces should now be rare — if you still see "mailbox not found" errors, the issue may be elsewhere, like a typo in the email address, a rejected domain, or a misconfigured DMARC policy.

Not all email problems stem from SPF, but a corrected SPF record removes one major barrier to deliverability. If you're sending bulk emails, use a tool like bulk email verification to clean your list before sending, catching invalid, catch-all, or disposable addresses early. This reduces bounce rates and protects your sender reputation, which directly impacts inbox placement.

Ultimately, fixing SPF is just one step. Consistent monitoring of logs and ongoing list hygiene are what keep deliveries reliable over time.

How Can You Prevent This Error Before Sending?

You can avoid SMTP 550 errors from incorrect SPF records in AWS SES by verifying email addresses before sending, confirming your domain’s SPF, DKIM, and DMARC records are correctly configured, and testing deliveries with a small list after any changes. This stops invalid or non-existent addresses from triggering bounces and protects your sender reputation.

Verify addresses before sending

  • Use a reliable email-verification tool to screen your list for invalid, non-existent, or disposable email addresses before sending.
  • Run your entire list through a bulk verification service—like bulk verification—to flag problematic entries and reduce bounce rates.
  • Catch role accounts (e.g. admin@, sales@) and catch-all domains early, as they're often ignored or rejected, leading to delivery failures.

Validate your DNS records regularly

  • Double-check your SPF record syntax using a DNS checker tool like MxToolbox—common issues include missing include tags, too many lookups, or incorrect IP ranges.
  • Ensure SPF doesn’t conflict with DKIM or DMARC; overlapping or contradictory policies can trigger email rejection.
  • Test SPF, DKIM, and DMARC alignment using tools that validate published records in real time—not just in theory.

Test small batches after changes

  • Always send a test batch of 5–10 emails after updating DNS records or switching email providers.
  • Use inbox-placement testing to see how your emails land in real inboxes, not just test providers' servers.
  • Monitor logs in AWS SES and check for 550 errors—especially after configuration updates—to catch failures early.

Why Email Verification Reduces SMTP 550 Errors Proactively

You can’t send to a mailbox that doesn’t exist—and SMTP 550 errors often mean exactly that. If your list includes invalid addresses or domains that don’t accept mail, AWS SES will reject those sends. Email verification catches these issues before you send, reducing bounces and protecting your sender reputation. Tools like Emaillistchecker.io check for real mailbox existence, SPF alignment, MX record validity, and catch-all configurations to flag problematic addresses before they cause 550 errors.

How Validity Checks Prevent 550 Failures

Even with a correct SPF record, sending to a non-existent or rejected address will still result in a 550 error. That’s because the SMTP handshake fails at the receiving end when the mailbox doesn’t exist. Let’s say your list includes an address like [email protected]. Your SPF checks out, but the domain’s MX records don’t resolve to a valid mail server. The sending server gets a 550 from the MTA, and the message is rejected.

Email verification tools prevent this by testing each address at the protocol level. For instance, Emaillistchecker.io uses real SMTP transactions to confirm whether the domain accepts mail and whether an individual mailbox can receive messages—without sending any content. This includes checking for catch-all setups, which often look valid on paper but can still result in undeliverable messages or spam complaints.

Why Proactive Checks Matter for AWS SES Reputation

Even one failed send due to a non-existent mailbox can harm your deliverability. Amazon SES monitors bounce and complaint rates closely. If you consistently try to send to non-existent addresses, your volume may be throttled or your account restricted. The solution isn’t just fixing SPF records—it’s ensuring your list only contains addresses that actually receive mail.

With 98.9% accuracy, Emaillistchecker.io identifies and removes invalid, catch-all, or disposable email addresses before you send. This includes domains that have no MX records, invalid SPF configurations, or mail servers that reject all messages. You’re not just improving one metric—you’re reducing the risk of blacklisting and protecting your sender reputation over time.

Use a bulk verification process to clean your list before campaigns: clean your entire list with real-time verification. Or integrate the API for automated checks during sign-up and data collection. Both help you catch problems before they trigger 550 errors, even when SPF is technically correct—because the mailbox still might not exist.

How to Use Emaillistchecker.io to Fix List-Level Issues Before AWS SES Sends

You can prevent SMTP 550 errors caused by invalid or undeliverable email addresses by verifying your list before sending through AWS SES. Emaillistchecker.io scans your entire list for syntax errors, unknown domains, catch-all responses, and domain-level issues like weak or missing SPF, DKIM, or DMARC records. Fixing these issues upfront reduces bounce rates and protects your sender reputation, directly lowering the risk of 550 errors at the mail server level.

Step-by-Step: Clean Your List Before Sending

  1. Upload your email list to Emaillistchecker.io via the bulk verification tool. The process takes minutes, no setup required. You’ll get immediate feedback on every address.
  2. Review flagged addresses—the tool identifies invalid syntax (like missing @ or domain), unknown domains (no DNS MX record), and catch-all responses (where mail servers accept all addresses regardless of existence). These are common causes of 550 errors when AWS SES tries to deliver.
  3. Check domain-level issues—Emaillistchecker.io also tests the SPF, DKIM, and DMARC records of each domain in your list. Missing or misconfigured SPF records are a frequent root cause of 550 errors with AWS SES. The tool highlights weak configurations that could lead to rejection.
  4. Download the cleaned list—you’ll receive a filtered version containing only valid, deliverable addresses. This reduces send volume to invalid targets and lowers the chance of being flagged for spam.
  5. Integrate with your workflow—if you use tools like Mailchimp, HubSpot, Klaviyo, or SendGrid, you can sync verified lists via native integrations. Once cleaned, send only to confirmed deliverable addresses, minimizing delivery failures and protecting your sender reputation.

Why This Works for AWS SES

Many 550 "mailbox not found" errors stem not from misconfigured mail servers, but from sending to invalid or poorly authenticated addresses. According to RFC 7505, a mailbox error should only be returned when a recipient does not exist and the domain has proper MX/DNS configuration. When SPF records are missing or incorrect, AWS SES may treat the delivery attempt as suspicious, increasing the chance of rejection. Emaillistchecker.io addresses this on the list level—before sending—by validating both individual addresses and domain security policies.

With a 98.9% accuracy rate, Emaillistchecker.io helps you focus on deliverable contacts. You’re not guessing. You’re testing. And you’re reducing the technical friction that leads to 550 errors in AWS SES.

How to Test Deliverability Before Full Campaign Deployment

You can catch SPF, DKIM, and reputation issues before your campaign goes live by sending test emails to real inboxes through inbox-placement testing. This mimics actual delivery conditions—checking spam filters, mailbox rejections, and genuine inbox placement—not just technical correctness. Tools like Emaillistchecker.io’s inbox-placement feature simulate real-world delivery across multiple providers, giving you hard data before you send at scale.

Verify Your Setup with Real In-Box Tests

  • Use inbox-placement testing to send test emails to real email addresses across Gmail, Yahoo, Outlook, and other major providers.
  • Test isn’t just about reaching the inbox—it includes whether your message lands in the primary tab, gets flagged as spam, or is silently discarded.
  • Check if your AWS SES configuration (including SPF, DKIM, and domain authentication) passes not just in theory but in actual delivery paths.
  • Review results across multiple test runs: inconsistent delivery suggests problems with sender reputation, IP warm-up, or content filtering.

Test Beyond Technical Rules

  • SPF and DKIM can be technically correct but still fail delivery if your IP or domain has poor reputation.
  • Even with proper SPF, a message may be rejected if the sending domain has a history of spam or high bounce rates.
  • Use inbox placement to uncover if your current IP or domain is on a blocklist—common with newly configured or high-volume senders.
  • Mail providers like Google and Microsoft use machine learning to assess sender behavior. A few test sends can reveal whether your content triggers filtering, even if your headers are clean.
  • Test during peak hours: delivery performance can vary based on time of day and server load. RFC 5321 defines SMTP behavior, but real-world performance depends on dynamic filtering and load balancing.
Don’t trust a “correct” SPF record alone. Your email must pass deliverability in practice, not just configuration.

Once your tests show consistent inbox placement across major providers, you can confidently scale. It’s the only way to know if your AWS SES setup—SPF, DKIM, and reputation—actually works in the real world.

You Don’t Need to Fix SPF Alone—Use Verified Lists Instead

Correcting SPF records in AWS SES is essential, but it doesn’t fix outdated or invalid email lists. Sending to stale addresses still triggers bounces, harms sender reputation, and risks blacklisting.

Even with proper authentication, poor list hygiene leads to poor deliverability. The real fix is removing invalid, dormant, or trap emails before sending.

Improve deliverability with verified email lists

  • Remove invalid addresses before sending
  • Avoid spam traps and bounce-heavy domains
  • Improve inbox placement with clean data

With Emaillistchecker.io, you can verify entire lists in bulk and test deliverability in real inboxes. Start with 100 free verifications—credits never expire.

Sources

  • Validity's analysis of 22+ million domains found 84% of domains used in email From addresses have no published DMARC record at all. — Validity (2024)
  • By early 2026, 937,931 of 1.8 million analyzed domains had valid DMARC records — up 79% in three years — but about 56% of them still sit at monitoring-only p=none. — DMARC Report (EasyDMARC 2026 data) (2026)

Keep reading

Ready to put this into practice? Emaillistchecker.io verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

Can a 550 error be caused by something other than SPF?

Yes. Other causes include missing DKIM, misconfigured DMARC, blocked sender IPs, or recipient mailbox limits. But SPF is the top cause when sending through AWS SES.

Does AWS SES update SPF automatically?

Yes, when you enable SPF in the console for a verified domain. It adds include:amazonses.com to your DNS record.

What if my SPF record already includes amazonses.com but I still get 550 errors?

Check for incorrect syntax, duplicate includes, or exceeding the 10 DNS lookup limit. Use a validator to confirm the full chain resolves correctly.

How long does SPF propagation take?

DNS changes typically take 1 to 24 hours to fully propagate. Test again after waiting.

Can I use Emaillistchecker.io to verify if my domain’s SPF is valid?

Yes. It checks domain-level configurations, including SPF, MX, and DNS records during bulk verification.

Does Emaillistchecker.io work with AWS SES?

Yes. It integrates with AWS SES workflows by cleaning your list before sending, reducing bounce rates and improving deliverability.

How accurate is Emaillistchecker.io?

It has a 98.9% verification accuracy rate, based on real-world tests across multiple mail providers.

Can I verify email lists before sending to AWS SES?

Yes. Use the bulk verification tool to clean your list. Only send to valid, deliverable addresses.

Are there free verifications available?

Yes. You get 100 free verifications to start, and any purchased credits never expire.

What does 'catch-all' mean in email verification?

It means the mail server accepts all incoming email for that domain, even for non-existent addresses. Such emails may still bounce later.

How do I know if AWS SES is rejecting my emails due to SPF?

Check the bounce message. If it includes '550 mailbox not found' and references 'SPF failure,' the issue is likely a misconfigured SPF record.

Can I merge Emaillistchecker.io with Mailchimp or Klaviyo?

Yes. It integrates directly with Mailchimp, HubSpot, Klaviyo, and SendGrid to verify lists before sending.