I've been sending outbound emails through Amazon SES, and I've noticed that some of them are bouncing back with an error message saying '550 5.7.509 Access denied, sending domain mydomain.com does not pass DMARC verification and has a DMARC policy of reject.' I've set up my DMARC correctly, and online tools confirm that everything is fine, but I'm still getting these bounce backs. It seems like these are coming from Microsoft Office365 servers. How can I diagnose the issue with DMARC? Are there any tools that can help me figure out what's going wrong?
3 Answers
It sounds like this is likely a DKIM alignment issue rather than a DMARC record issue, which is why your tests show that DMARC looks fine. Have you tried sending a test email from your domain to see the results? There’s a tool at suped.com/tester that can help identify the issue more clearly.
Make sure you've set up DKIM signing in SES. That could be a simple fix to avoid those bounce backs!
You might want to check your DMARC aggregate reports for any discrepancies. Microsoft tends to be stricter about alignment checks. Make sure SES is set up correctly for DKIM and SPF alignment with your domain. You could use tools like DMARCLiance or EasyDMARC to analyze your reports. Also, it's worth noting that the bounces might be intermittent, so check the headers of the bounced emails for more specifics.
That's helpful! I ran a check using the dmarcian tool, and it mentioned, "*We couldn't find any DKIM records often associated with popular email sending sources*." I don't have a "Custom MAIL FROM domain" configured in SES because I'm not using any subdomains. Could that be a potential issue?
I suggested something similar earlier. Could you take a look at my previous responses?