Amazon Workmail is Rejecting all Email After Re-Verifying the Domain

Question

I have recently moved my hosting to a private server and Amazon didn't send us an email telling us that we needed to re-verify our domain. When we got the email, it was telling us that we had missed the 5 day window and our email officially was cut off. Our email is absolutely critical to our business, so this is a very urgent issue.

I have gone through the re-verification process and have added the CNAME record, MX record and TXT records for the Workmail service and it has now been 72 hours. I need to verify and get my email back ASAP.

I have "discussed" this with the AI assistant and it says everything should be good and I should just have to wait but propagation should have been complete by now.

What have I missed or what can I do? This is ruining our relationship with several clients.

re:Post Agent · Answer

I understand your frustration with this critical email issue. Based on the information provided, it seems you've taken the correct initial steps to re-verify your domain with Amazon WorkMail. However, there are a few additional things you can check and actions you can take to resolve this issue:

1. Double-check all DNS records: Ensure that your MX record points only to WorkMail and has the lowest priority. Multiple MX records or incorrect priorities can cause delivery issues.

2. Verify DMARC settings: Check your Domain-based Message Authentication, Reporting, and Conformance (DMARC) settings in the Amazon WorkMail console. Incorrect DMARC settings can affect email delivery.

3. Check Amazon SES inbound rules: Ensure that the Amazon Simple Email Service (SES) inbound rule is correctly set up to route emails to your WorkMail organization. If there are any other actions in the rule, they might interfere with WorkMail receiving mail.

4. Enable message tracking: Turn on email event logging in Amazon WorkMail to check for any specific delivery problems.

5. Verify SPF record: Make sure your Sender Policy Framework (SPF) record includes Amazon SES. You can check this on the domains page in the Amazon WorkMail console.

6. Re-add the domain: If WorkMail doesn't have the correct permissions to use the domain, try adding the domain again in the WorkMail console. This can trigger a workflow to check and correct various domain settings.

7. Check SES permissions: Ensure that WorkMail has the necessary permissions to send emails on your behalf. You may need to create a custom policy in Amazon SES for your verified identity (domain) that allows WorkMail to use SES for sending emails.

If you've already completed these steps and are still experiencing issues, I recommend contacting AWS Support directly for further assistance, given the critical nature of your email service to your business. They can provide more specific guidance based on your account and configuration details.  
**Sources**  
[Mail routing - Amazon WorkMail](https://docs.aws.amazon.com/workmail/latest/adminguide/mail-routing.html)  
[Sending Email failed in Workmail | AWS re:Post](https://repost.aws/questions/QUOH7q7vwhRH-jM2L7ItqUoQ/sending-email-failed-in-workmail)

Amazon Workmail is Rejecting all Email After Re-Verifying the Domain

Relevant content