Field notes
Email deliverability fix guides
Sending problems that look like nothing is wrong. The API returns a message ID, the logs say success, and the mail never arrives. Each note takes one of those, explains what is actually happening, and gives you a script in Python and Node.js that detects it — and repairs it where the API allows.
DNS & domains covers the record layer — SPF syntax, DKIM selectors, DMARC policy, MX targets. This section covers the layer above it, where the sending platform's own API is what finds and fixes the problem. If your records are wrong, start there. If your records are right and mail still is not arriving, start here.
Amazon SES and deliverability
SES suppression list silently blocks a real customer
The customer never got the email and SES reported no error. Their address sits on the account-level suppression list from an old bounce, so the send is dropped.
SES silently rejects real recipients because the account is still in the sandbox
Mail to your own address works, mail to customers fails with MessageRejected. The account never left the SES sandbox, which only allows verified recipients.
SES bounce rate creeping toward account review
AWS reviews accounts at a 5% bounce rate and 0.1% complaints. The dashboard shows today, not the trend, so the first warning is often the review email itself.
SES bounces and complaints are invisible with no event destination
SES returns a MessageId whether or not the mail is delivered. With no event destination on the configuration set, nothing records what happened next.
SES passes SPF and DKIM but DMARC still fails
SPF passes, DKIM passes, DMARC fails. The Return-Path is an amazonses.com subdomain, so SPF authenticates a domain that is not the one in the From header.
SES identity still shows verified but its DKIM records have drifted
SES shows the domain as verified while the DKIM CNAMEs no longer resolve. Signing degrades quietly after a DNS migration, and DMARC starts failing weeks later.
Provider records added to the root instead of the sending subdomain
Verification never completes because the CNAMEs were added at the apex. The provider is looking for them one label deeper, on the sending subdomain.
Missing List-Unsubscribe now gets bulk mail rejected outright
Gmail and Yahoo moved from soft deferrals to permanent 550 rejections. Bulk marketing mail without one-click unsubscribe headers is refused outright.
These are the ones I keep hitting. If yours is broken in a way none of them describes, tell me on LinkedIn — it is usually how the next note gets written.