Resend Domain Verification Token for Amazon SES

Why You Can’t Send Emails After Amazon SES Domain Verification Fails

You just set up Amazon SES to send transactional emails, but your first test message bounces with “DomainNotVerified.” You didn’t expect the setup to stop dead in its tracks—especially after configuring DNS correctly.

Amazon SES blocks all outbound mail until your domain is verified. If you miss the verification window or lose the token, sending is disabled. No amount of retries, no matter how many emails you queue, will change that. The mail stays stuck in limbo—undelivered or marked as spam.

That’s the reality of domain verification in Amazon SES: once it’s failed, you can’t send until you manually restart it. Finding the right tool to resend the token isn’t always obvious. This is why knowing how to resend the domain verification token for Amazon SES is essential.

Key takeaways

Amazon SES requires domain verification before any outgoing mail is allowed.
Missing the verification window or losing the token disables sending until you restart the process.
You can only resend the domain verification token via AWS Console or AWS CLI—no third-party tools offer this feature directly.

Can You Resend the Domain Verification Token for Amazon SES?

You cannot resend the domain verification token in Amazon SES. If you miss it or it expires, you must start the verification process again from the AWS Management Console. There’s no built-in 'resend' button—only a manual restart works.

How Domain Verification Works in Amazon SES

When you verify a domain in Amazon SES, AWS generates a unique TXT record that you must add to your domain’s DNS configuration. This record contains a token that proves you control the domain. AWS does not store or reissue this token. Once it's gone, it's gone.

Verification tokens are temporary—typically valid for 72 hours. If you don’t complete the setup within that window, the token expires. The system will not automatically regenerate it. You’ll need to re-initiate the entire verification flow.

What You Need to Do If You Lose the Token

Let’s be clear: the only fix is to restart. Go back to the Amazon SES console, select your domain, and choose “Verify Domain” again. This will generate a new TXT record and a new token. You’ll need to update your DNS records with the fresh token and wait for AWS to validate the change.

This process takes up to 72 hours in some cases, especially if your DNS provider takes time to propagate changes. You can monitor verification status in the SES console.

If you're integrating with a third-party tool or application, double-check that you're using the correct domain and that your DNS zone is properly configured. A single typing error in the TXT record will fail verification.

For teams managing multiple domains or high-volume sends, automating DNS checks and verification status monitoring helps prevent delays. You can test your domain setup with tools like MXToolbox or DNSChecker to confirm TXT record propagation.

If you’re sending to large lists, using an email verification service before sending can help avoid verification issues altogether. Bulk email verification checks addresses for validity, role accounts, and deliverability risks before you send—reducing bounce rates and protecting your sender reputation.

How to Resend Your Amazon SES Domain Verification Token

Log in to the AWS Management Console, go to Amazon SES, select your domain under 'Identity' > 'Domains', and click 'Verify Domain' again. AWS will generate a new TXT DNS record and verification token. Update your domain’s DNS settings with the new TXT value, wait 5–15 minutes for propagation, then return to the console to confirm verification status. You can resend the token anytime if it expires or gets lost.

Step-by-Step: How to Resend the Verification Token

Log in to the AWS Management Console. Use your IAM user or root credentials with proper SES permissions.
Navigate to Amazon SES. You’ll find it in the list of services or via the AWS search bar.
Go to 'Identity' > 'Domains'. This section lists all domains you’ve registered with SES.
Select your domain and click 'Verify Domain'. Even if it was previously verified, clicking this again triggers a new verification process.
AWS generates a new TXT record and token. The system updates the DNS record requirement in real time. This is critical—using an outdated token won’t work.
Update your DNS provider with the new TXT value. Copy the full value from the AWS console and paste it into your DNS zone file. Make sure the record type is TXT.
Wait for DNS propagation (typically 5–15 minutes). While DNS changes can be near-instant, many providers take up to 15 minutes. Use dnschecker.org to confirm global propagation.
Return to the AWS console and confirm the status. After propagation, refresh the console. The domain should now show as "Verified" under the identity list.

Why This Works

Amazon SES requires domain-level verification to prevent spoofing and abuse. Each verification is tied to a unique DNS TXT record, which proves you control the domain. Resending the token doesn’t change the underlying requirement—only the specific DNS value. This process aligns with RFC 7208 (DMARC), which mandates verified sender identities for trusted email delivery, especially for bulk sends.

If you’re sending to large lists, ensure your domain and IP reputation are clean. A high bounce rate or poor sender reputation can still block delivery, even after verification. That’s where tools like MailTester’s email checker help—verify each address before sending to reduce bounces and protect your sender reputation.

Common Reasons Domain Verification Fails After Resend

Resending a domain verification token for Amazon SES often fails not because of the resend, but due to lingering DNS issues: propagation delays, misconfigured records, or caching from third-party providers like CloudFlare. Even after you reconfigure your DNS, the internet doesn’t update instantly. Let’s walk through the most common culprits and how to fix them.

DNS Propagation Delay

After updating your DNS records, changes can take 1 to 48 hours to propagate globally. This is normal. Wait at least 24 hours before assuming a failure—Amazon SES checks DNS at intervals, not in real time.
Use tools like MXToolbox or DNSChecker.org to verify your record is visible across different global locations before retrying.

Incorrect or Mislabeled DNS Records

Even a single misplaced character in your TXT record can cause rejection. Double-check that the value starts and ends with a quote only if required by your provider—most TXT values don’t need quotes unless they contain spaces or special characters.
If you previously used a CNAME or SPF record for another service, ensure it’s been fully removed. Conflicting records may not trigger an error, but they can prevent Amazon SES from validating your domain.
If you're using CloudFlare or a similar CDN, verify that DNS caching is not overriding your changes. Aggressive TTL settings can delay updates even after your record is updated in the dashboard.

Third-Party DNS Caching

CloudFlare and other providers often cache DNS results for longer than the record’s TTL. You may see stale data even after a change.
Clear the cache directly in your provider’s dashboard (e.g., CloudFlare’s “Purge Cache” option) or temporarily disable proxying (set DNS to "DNS only" mode) when validating changes.
Use RFC 1035 to understand how DNS TTL values affect propagation timing — it’s not just a recommendation, it’s how the system is designed to work.

If you’re still unable to verify after addressing these, check your AWS console logs and ensure you’re applying the record to the same domain you’re attempting to verify. You can also use a tool like the MailTester email checker to validate whether the domain’s DNS setup is correctly resolving, especially if you’re managing large lists.

How MailTester Helps You Verify Your Domain Without AWS Workarounds

You don’t need to send test emails through AWS to verify your domain for Amazon SES. MailTester checks your domain’s DNS records—specifically TXT records—directly and instantly, so you can confirm your setup is correct before you launch. No sending, no delays, no AWS-side workarounds.

Test Your DNS Configuration Before You Send

Before you even configure Amazon SES, you can use MailTester’s real-time API to validate your domain’s TXT records. This lets you catch problems early—like missing entries, typos, or incorrect syntax—before they cause verification failures. It’s a faster, more reliable way than guessing and re-trying through AWS.

Many SMTP services require domain verification via TXT records, and a single syntax error (like an extra space or unquoted value) can break the entire process. MailTester checks for malformed entries, expired TTLs, and missing records automatically. If you’re unsure what your record should look like, the standard for domain verification is defined in RFC 7208, which governs SPF records, a related but separate mechanism.

Proactively Avoid Blocked or Bounced Sends

Verifying your domain through AWS is not the same as ensuring your email can actually reach inboxes. Your DNS setup must be correct, and your sender reputation must be clean. MailTester’s verification is not just about proving you own the domain—it’s about checking the technical foundations of deliverability.

For example, even if your TXT record is present, a catch-all configuration or a role-based email address might not respond properly. MailTester detects those edge cases by analyzing how domains respond to inbound queries. If you’re setting up a new domain for bulk email, this kind of upfront validation prevents costly delivery issues later.

Use the real-time API to programmatically check thousands of domains or just a handful. It’s ideal for teams that need to automate domain validation before connecting platforms like Amazon SES, SendGrid, or HubSpot. The API returns exact feedback—valid, invalid, catch-all, or risky—so you know exactly what to fix.

Even if you’re already using AWS, testing your DNS configuration outside AWS gives you more control. You’re not depending on AWS’s error messages, which can be vague. With MailTester, you see the actual state of your domain’s records, in real time.

Why You Should Verify Your Domain Before Using Amazon SES

You should verify your domain before using Amazon SES to avoid sending failures, protect your sender reputation, and prevent unintended spam flags. Without verification, your emails may be rejected outright or end up in spam folders, even if your content is clean. Let’s walk through why this step isn’t just a formality.

What Happens If You Skip Domain Verification?

Amazon SES will reject any emails sent from an unverified domain—no exceptions.
Unverified identities can lead to high bounce rates, which hurt your sender reputation over time.
Malformed DNS records or typos in your SPF/DKIM setup can still allow sending—but only if the domain isn’t verified, making detection of issues harder.
Without verification, Amazon doesn’t know whether you’re the legitimate owner, so it may block your traffic to be safe.

Key Risks of Skipping Verification

Senders often waste hours retrying deliveries without understanding why they fail—verification catches broken DNS setups early, saving time.
Many providers block messages from unverified domains automatically, even if the content is valid. For example, Gmail and Outlook often treat unverified domains as suspicious by default.
Accidental misuse of unverified domains—like using a test domain in production—can result in sudden blacklisting without warning. According to RFC 5321, the SMTP protocol requires domain identity validation to mitigate abuse.
Even if you send a few test messages, failed deliveries can trigger warnings that linger in spam scoring systems, reducing long-term inbox placement.

Let’s be clear: verifying your domain isn’t a one-time checkbox—it’s foundational. It ensures that Amazon SES treats your domain as trustworthy from day one. If you're planning to send transactional or marketing emails at scale, skipping this step makes your entire outbound flow fragile.

If you're already working with a list of addresses, double-checking validity before sending is just as critical. You can use a real-time email verification API to ensure only active, deliverable addresses go out. It’s not a replacement for domain verification—but it’s a smart complement.

Don’t let a missing TXT record or a forgotten token derail your campaign. Verification isn’t just a setup step. It’s deliverability insurance.

MailTester’s Role in Avoiding Amazon SES Domain Verification Issues

You can avoid Amazon SES domain verification delays by validating your DNS records—TXT, SPF, DKIM, and MX—before setup. MailTester’s API runs a single real-time check across all these records, telling you instantly if they’re published correctly or missing. This prevents failed verification attempts and reduces the risk of being blocked by AWS’s strict checks.

Check DNS Records Before You Configure Amazon SES

Setting up Amazon SES requires your domain to pass DNS validation. If records are misconfigured or missing, the process fails — and you’ll get a bounce or an indefinite wait. Let’s be clear: Amazon SES doesn’t accept partial or incorrect configurations. Running a DNS check upfront with MailTester ensures you’re not wasting time on retries.

You don’t need to manually test each record type. The MailTester API verifies TXT, SPF, DKIM, and MX in one call. It checks syntax, propagation, and presence, and returns a detailed report. You’ll know immediately if an SPF record has a syntax error or if DKIM is missing from your DNS.

Bulk Validation for Multiple Domains

If you manage multiple domains for Amazon SES, testing each one individually isn’t practical. MailTester’s bulk verification lets you validate dozens of domains at once. This is especially useful for agencies, large senders, or teams handling multi-product campaigns. It cuts down setup time from days to minutes and catches issues before they cause delivery failures.

For developers, the MailTester verification API integrates easily into your deployment workflow. You can run checks as part of your CI/CD pipeline or during onboarding flows. It’s a lightweight, reliable way to automate DNS validation and avoid common SES setup traps.

While Amazon SES enforces its own domain policies—such as requiring SPF to include the AWS SES sending domain—it doesn’t always warn you about subtle issues like incorrect SPF syntax or multiple SPF records. These are the kind of pitfalls MailTester helps you catch early. The real risk isn’t just a failed verification—it’s reputation damage from sending from a domain with weak or conflicting email policies.

For a more complete delivery workflow, also test inbox placement with MailTester’s inbox placement tool, which simulates how your messages land in real inboxes across Gmail, Outlook, Apple Mail, and more. This gives you insight into how your verified domains perform in practice—not just in theory.

According to RFC 5321 and the industry-standard practice laid out by organizations like RFC 5321, email delivery depends entirely on correct DNS configuration during the SMTP handshake. That’s why pre-verification matters.

What Happens If You Don’t Verify Your Amazon SES Domain?

You cannot send any emails from your domain using Amazon SES until you verify it. All attempts to send will fail with a 550 error, meaning your messages are blocked at the SMTP level. Without verification, your sender reputation remains unestablished, leading to inconsistent inbox placement and poor deliverability. You’ll waste time, effort, and resources on campaigns that never reach inboxes.

Here’s what you lose when verification is skipped:

You cannot send emails from your domain via Amazon SES at all — the service blocks all outbound traffic until domain ownership is confirmed.
All outgoing messages are rejected at the SMTP level with a 550 error code, which means the mail server explicitly denies delivery before any content is processed.
Without verification, Amazon SES doesn’t assign a sender reputation score, so your messages are treated as untrusted — often landing in spam or being dropped silently.
Even if some messages get through, delivery is unstable. Some users see the email, others don’t — and there's no way to track reliable delivery metrics.
You gain no data on real delivery, open rates, or engagement because no successful deliveries occur to begin with.
Any attempt to warm up your sending volume or build sender reputation fails — without verification, you’re locked out of the system.

Why verification isn’t just a formality

Amazon SES requires domain verification not as a hurdle, but as a security measure. It ensures that only the rightful owner can send from a domain, preventing impersonation and abuse. The process involves adding a DNS TXT record to prove ownership — a simple step, but one that’s required for every domain you want to use with SES.

If you’re managing email campaigns across multiple domains, skipping verification for one means that one domain is effectively unusable. This isn’t a temporary delay — it's a complete block. The same applies to sending transactional emails like password resets or order confirmations. These depend on SES and will fail without a verified domain.

For teams using third-party tools, this also breaks automated workflows. Tools like Mailchimp, HubSpot, or Klaviyo will fail to send emails via SES if the domain hasn’t been verified — even if everything else is set up correctly.

Let’s be clear: no amount of campaign budget or design will fix sender rejection if the domain isn't verified. You can’t build trust or engagement if your message never leaves the server.

Use MailTester’s email checker to validate addresses before sending, and inbox placement testing to verify whether your messages reach inboxes — but only after your domain is verified in SES.

Best Practices for Domain Verification and Maintenance

Verify your domain DNS records before enabling any sender identity in Amazon SES. Never rely solely on the AWS Console—store verification tokens securely and monitor them periodically. After major DNS changes or annually, re-verify to prevent unexpected sending failures. Use automated tools to detect drift, and test inbox placement to confirm delivery reliability.

Why domain verification matters

Amazon SES requires domain verification to prevent spoofing and maintain sender reputation. Without it, your messages may be rejected or marked as spam.
Always verify the DNS records (MX, TXT, or SPF) before enabling a new email identity. A failed verification breaks email deliverability completely.
Store your verification tokens in a secure, version-controlled system—not just in the AWS Console, which you might lose access to.

How to maintain verified domains

Use automated tools to monitor DNS record health. DNS changes can break verification silently—tools like MxToolbox can check DNS records across global networks.
Re-verify your domain annually or after any DNS infrastructure change, such as switching providers or updating routing policies.
Verify new sender identities using a dedicated email address or subdomain to reduce risk of unintended leakage.
Test inbox placement for your domains using real email clients. Tools like MailTester’s inbox placement tester simulate delivery across Gmail, Outlook, and other inboxes.
Before sending to large lists, validate your email addresses using bulk verification. MailTester’s bulk verification checks syntax, domain health, and inbox likelihood at scale.

Even with perfect setup, domain verification can fail silently. Running checks before and after send events helps catch these issues early. The key is not just setting up records—but maintaining them with care.

Final Step: Confirm Your Domain Is Fully Verified in Amazon SES

After updating your DNS records, wait 1–5 minutes for propagation, then check the Amazon SES console. The domain status should update from “Pending” to “Verified” within that window. If it doesn’t, verify the TXT record and use a public DNS lookup tool to confirm it’s live.

Step-by-step verification process

Wait 1–5 minutes after DNS changes. DNS propagation isn’t instant. Amazon SES checks your domain’s DNS records periodically, so allow time for changes to take effect across global name servers. A 1-minute delay is common; longer waits can happen during peak times.
Go to the Amazon SES console. Sign in to your AWS account, open the SES dashboard, and navigate to the “Domains” tab. Locate the domain you just verified and check its current status.
Confirm the status changed to “Verified.” Once propagation completes, the status should update automatically. This means AWS can now send email from your domain on your behalf, using your DKIM authentication.
If it stays “Pending,” recheck the TXT record. Use a public DNS lookup tool—like MXToolbox or Google’s DNS lookup—to verify the exact TXT record is present and matches what Amazon SES requires.
Check for typos or formatting errors. Even a missing quote, extra space, or incorrect domain name can cause failure. The full record must match the one Amazon SES provided, including the correct value and domain. Double-check that the record is not truncated or misformatted in your DNS provider.

What happens if verification fails?

Failure usually means a misconfigured record. Common issues: missing quotes around the value, incorrect domain name, or a typo in the text field. If you're unsure, remove and re-add the record. You can also test email deliverability using a real sender setup after success. For broader validation, consider using a tool to check individual addresses before sending to ensure no invalid recipients slip through.

Automate Verification, Avoid Mistakes, Send with Confidence

Domain verification for Amazon SES isn’t a one-time checkbox. It’s the foundation of your email deliverability. Skipping proper validation risks bounces, poor inbox placement, and sender reputation damage.

Use MailTester to test your domain setup before configuring AWS. Catch errors early, validate DNS records, and confirm MX and SPF alignment — all before sending a single message.

With 98.9% accuracy and credits that never expire, MailTester provides reliable verification for your entire email infrastructure. Start free with 100 verifications — no risk, no deadline.

Sources

Since May 5, 2025, Microsoft Outlook requires SPF, DKIM, and DMARC from domains sending 5,000+ emails per day, rejecting non-compliant mail outright at the SMTP level with error 550 5.7.515. — Microsoft Outlook requirements (via MailOver bulk-sender requirements guide) (2025)
Sending from a domain with at least three months of history improves inbox placement by 28% compared with a brand-new domain. — Woodpecker data (via WarmForge deliverability statistics) (2025)

Keep reading

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

Can I get a new Amazon SES domain verification token after it expires?

Yes, but you must restart the verification process in the AWS console. Amazon SES does not resend expired tokens.

What happens if my Amazon SES domain verification token expires?

Your domain remains unverified. You cannot send emails until you re-initiate verification and complete DNS setup.

How long does DNS propagation take for Amazon SES domain verification?

Typically 5 to 15 minutes, but may take up to 24 hours depending on DNS TTL and caching.

Can I verify multiple domains with Amazon SES?

Yes, you can verify multiple domains under the same AWS account. Each must go through the DNS verification process separately.

What is the difference between domain and email address verification in Amazon SES?

Domain verification authenticates the entire domain for sending. Email address verification is only for individual senders and is not required for bulk sending.

Can MailTester verify my Amazon SES domain setup?

Yes — MailTester checks DNS records like TXT, SPF, DKIM, and MX. It verifies your domain’s configuration before you launch Amazon SES.

How does MailTester help avoid Amazon SES verification failures?

It identifies DNS misconfigurations, missing records, and propagation delays before you begin verification, reducing errors by 90% in practice.

Is MailTester free to test domain verification for Amazon SES?

Yes — you get 100 free verifications to test your domain’s DNS setup at no cost, with no expiration on purchased credits.

What happens if my Amazon SES domain is rejected during verification?

Review the rejection reason in the AWS console. Common causes include DNS errors, misconfigured records, or invalid domain format.

How do I handle a 'Failed' status in Amazon SES domain verification?

Recheck your TXT record, ensure proper propagation, clear cache, and restart the verification process in the AWS console.

Does MailTester integrate with AWS or Amazon SES?

No — MailTester does not integrate directly with AWS or Amazon SES. It works independently to test DNS and email address health.

Can MailTester reduce my bounce rate with Amazon SES?

Yes, by identifying invalid or non-deliverable addresses before sending, and by verifying domain setup to avoid sending failures.