SES '554 message rejected: email address is not verified' - agent sending from a new subdomain

TL;DR

SES only sends from verified identities, and verifying the root domain does not cover a new subdomain. Add the subdomain as a verified domain identity in the same AWS region the agent sends from, publish the DNS verification records SES gives you, wait for verification to complete, then retry the send.

The query

SES '554 message rejected: email address is not verified'  -  agent sending from a new subdomain

Steps

1. Confirm which identity SES is rejecting and in which region

Read the rejection and the agent's SES configuration. Note the exact From domain and the AWS region. SES identities are regional: a domain verified in one region is unverified in another.

Expected: you know the unverified domain and the region the agent uses.

2. Add the subdomain as a verified domain identity

In the SES console for that region, create a new domain identity for the exact subdomain. SES will provide DNS records (a TXT verification record plus DKIM records) to publish.

Expected: the identity exists in SES with status pending verification.

3. Publish the DNS records and wait for verification

Add the TXT and DKIM records to the subdomain's DNS. Verification usually completes within minutes of DNS propagation but can take longer. Refresh the identity status until it shows verified.

Expected: the SES console shows the subdomain identity as verified.

4. Check sandbox status before resuming

If the AWS account is still in the SES sandbox, verified identities can only send to verified recipients. Request production access if the agent needs to mail real leads.

Expected: production access granted, or sends limited to verified recipients by design.

5. Retry the send and confirm delivery

Re-run the agent's send for the previously rejected messages and watch for rejections. If the not-verified error persists, recheck that the region matches and the From domain exactly equals the verified identity.

Expected: sends succeed with no 554 not-verified rejections.

Use this when

• SES rejects with 554 email address is not verified
• The agent just started sending from a new subdomain
• Sends work in one AWS region but fail in another

Not for this skill when

• SES rejects with a sandbox recipient error on an already-verified sender (that is production access, not identity verification)
• The error is an IAM AccessDenied (that is permissions, not identity)
• Bounces come from the receiving provider after SES accepts the message

Variant phrasings

ses 554 message rejected email address is not verified

Short form of the same rejection. Same regional identity check.

amazon ses new subdomain not verified

Operator phrasing. The subdomain needs its own identity record.

ses says sender not verified after domain verification

Usually a region mismatch or the subdomain gap. Check both.

Why it happens

SES requires proof of control over every sending identity to prevent spoofing, and identities are scoped to both the exact domain string and the region. A new subdomain is a new identity, and agents constantly spin up subdomains for new campaigns or customers without anyone completing the SES verification step.

Edge cases

• Verifying the subdomain does not require re-verifying the root domain, but DKIM records differ per identity. Publish the exact records SES shows for the subdomain.
• If the agent assumes a role in another account, the identity must be verified in the account that actually sends.
• DNS propagation delays are the most common false failure. Wait and re-check status before changing anything.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstnBl8ALTVgiY9Olq1eTX3w