Ops-Free is paused for now. You can look around and use the free tools, but sign-in and sending are turned off.

Ops-FreeSES

Free tool

Amazon SES DNS checker

Type your domain to check the three records that decide whether SES mail lands in the inbox: DKIM, SPF and DMARC. You get a plain answer and the exact fix. No sign-up.

In the SES console: Identities → your domain → Authentication. DKIM records are unique to your SES identity, so we can only check them if you paste them.

What each record does

  • DKIM signs every message so receivers can tell it really came from your domain. SES gives each domain three DKIM CNAME records, and the identity isn't verified until all three are published.
  • SPF lists the servers allowed to send for your domain. A domain may have only one SPF record: two of them is a permanent error, and SPF then fails for every message.
  • DMARC tells receivers what to do when a message fails those checks. Start with p=none to monitor, then move to quarantine or reject.

The mistakes we see most

  • The domain typed twice. Many DNS providers add your domain to whatever you type as the name, so pasting the full name creates abc._domainkey.example.com.example.com. The checker spots this and tells you.
  • Two SPF records, usually one from the email host and a new one for SES. Merge them into one.
  • A free hosting subdomain such as myapp.vercel.app. You can't add DNS records there, so SES can never verify it. Use a domain you own.

Still stuck on getting out of the sandbox? Use the production access request writer.