AWS SES email receiving - 550 mailbox not found

Question

I've been trying to set up AWS Simple Email Service as a way to forward emails received to my custom domain on to my Gmail account, without any email hosting service required.

I have set up and verified my custom domain (mycustomdomain.com) as well as verified the email address they'll be forwarded to (myemail@gmail.com) as I'm still in Sandbox mode.

Under Email Receiving -> Rule Sets, I have an active / enabled rule set (forward-to-myemail-gmail) which is enabled, doesn't require TLS and has spam/virus scanning on.

• There are no recipients specified, which I believe should allow this rule to be triggered for ALL recipients under my custom domain.
• I have a single SNS action specified, which is to publish to the SNS topic (sns-forward-to-myemail-gmail) using base64 encoding

I have also set up my SNS topic as above and associated subscription, and have tested sending a notification to this topic manually using the console, so have confirmed it works.

However if I try sending an email to, for example, test@mycustomdomain.com, I get a bounce message back saying:

Address not found

Your message wasn't delivered to test@mycustomdomain.com because the address couldn't be found or is unable to receive email.

The response was:

550 Mailbox does not exist!

I've also confirmed that the MX records have been set up correctly using mxtoolbox.com, which says the domain records point to feedback-smtp.us-west-2.amazonses.com

Any suggestions for what I'm doing wrong? Many thanks!

Answer 1

There is one inconsistency between @rtatton and @BizAVGreg. I am wondering whether the TXT record should be as follows:

mail.customdomain.com   TXT "v=spf1 include:amazonses.com ~all"

Answer 2

Thanks for the answers above. For anyone else working through this, in my case the feedback value (for the mail.xxx.com had to be:

10 feedback-smtp.[region].amazonses.com

While the root domain value had to be:

10 inbound-smtp.[region].amazonaws.com

note that the feedback domain is AMAZONSES while the inbound domain is AMAZONAWS.

Answer 3

For anyone else that had some trouble understanding ChrisC's answer, here is more detail on what I needed to do. I setup my domain using Route53, but other domain providers is similar.

TL;DR

1. Create a custom MAIL FROM domain
2. Add the following records to Route53 or your DNS provider:

Record name	Type	Value/Route traffic to
mail.customdomain.com	MX	10 feedback-smtp.[region].amazonaws.com
customdomain.com	TXT	"v=spf1 include:amazonses.com ~all"
customdomain.com	MX	10 inbound-smtp.[region].amazonaws.com

Outbound mail

Go to the Amazon SES AWS console. Under "Configuration," go to "Verified Identities." Under "Custom MAIL FROM domain," provide a custom subdomain (e.g., mail.customdomain.com). Select the option to add the DNS records (an MX record and a TXT record) to Route53 (or just add them manually). See this page in the AWS docs regarding custom MAIL FROM domains.

Inbound mail

Go to the Route53 AWS console. Under "Hosted zones," click on the domain you want to enable for receiving emails. Add an MX record for the base domain (e.g., customdomain.com) with the following value [priority] inbound-smtp.[region].amazonaws.com, where [region] can be us-east-1, us-west-2, or eu-west 1 (see this page for full details). Do NOT use email-smtp.[region].amazonaws.com for receiving inbound mail. I received a 530 Authentication required error in the bounce email when attempting to do so.

See this page in the AWS docs regarding publishing an MX record for receiving SES email.

Answer 4

Ok I figured it out... User error, as expected!

I had two MX records, one for the "mail" subdomain and another for "@" meaning the base domain. Both were set to the feedback endpoint, which was the problem. I think I was misunderstanding the two MX records.

The "mail from" configuration that used the SES feedback endpoint needed to be set for the sending subdomain (mail.mycustomdomain.com) while the SES inbound SMTP endpoint should have been used for the receiving domain (@, which means mycustomdomain.com).

Before when I was setting both to the same value I found either get a verified MAIL FROM or received email but not both. Obvious in hindsight! Hope this helps someone else.