# Amazon SES "MAIL FROM domain is not verified": Causes and Fix

Source: https://wraps.dev/ses/errors/mail-from-domain-not-verified

Why SES rejects a send when the custom MAIL FROM domain is not fully verified, which DNS records it needs, and how to unblock sending.

## The error

```
Amazon SES could not read the MX record required to use the specified MAIL FROM domain.
```

AWS exception `MailFromDomainNotVerifiedException`. The Wraps CLI reports it as `SES_MAIL_FROM_NOT_VERIFIED`.

## Why this happens

The identity you sent from has a custom MAIL FROM domain configured, and that domain is not fully verified. A custom MAIL FROM needs its own DNS records, separate from the identity's DKIM records, and SES checks them at send time.

-   The custom MAIL FROM subdomain's MX record is missing or not yet propagated.
-   The SPF TXT record for the MAIL FROM subdomain is missing or wrong.
-   The records exist but SES has not re-checked and still reports the domain as pending.

## How to fix it

1.  ### 1. Check the DNS records SES is looking for
    
    A custom MAIL FROM domain needs an MX record pointing at the SES inbound endpoint for its region and a TXT record publishing SPF. Both go on the MAIL FROM subdomain, not the root domain.
    
    ```
    wraps email verify
    ```
    
2.  ### 2. Verify the records resolve publicly
    
    A record present in your DNS provider's UI is not the same as a record the internet can resolve. Query it from outside your network before assuming propagation is the problem.
    
    ```
    dig +short MX mail.example.comdig +short TXT mail.example.com
    ```
    
3.  ### 3. Or remove the custom MAIL FROM domain
    
    If you do not need SPF alignment for DMARC right now, removing the custom MAIL FROM in the SES console lets sending resume immediately. SES falls back to its own MAIL FROM domain.
    

## How to stop it recurring

### Wait for verified before you cut traffic over

SES reports the MAIL FROM domain as pending until it can read both records. Treat pending as not ready, not as nearly ready.

### Keep the MAIL FROM subdomain out of general DNS churn

The MX record on that subdomain exists solely for SES. A DNS cleanup that removes what looks like a stray MX record takes sending down with it.

## Common questions

### What DNS records does a custom SES MAIL FROM domain need?

An MX record on the MAIL FROM subdomain pointing at the SES inbound endpoint for that region, and a TXT record publishing SPF for the same subdomain.

### Do I need a custom MAIL FROM domain at all?

Only if you want SPF to align with your From domain for DMARC. Without it SES uses its own MAIL FROM domain, DKIM still aligns, and sending works.

### Why does SES still say pending after I added the records?

SES re-checks on its own schedule and DNS has to propagate first. Confirm both records resolve from outside your network, then give SES time to re-check.

## What Wraps does about this

The Wraps CLI generates the MAIL FROM records, validates them and waits for propagation as part of domain setup, and it maps this exception to SES\_MAIL\_FROM\_NOT\_VERIFIED with a pointer to \`wraps email verify\`. DNS stays in your control, so a record removed at the registrar still breaks sending.