SES can report your DKIM signing as fine while receivers fail the signature. The **authentication check** shows you what a receiver actually sees when mail from your domain arrives.

You'll find it on **Reports → Deliverability**, under the [Deliverability Score](/reports/deliverability-score) for the domain you've picked.

## What it does

When you click **Run authentication check**, SendOps:

1. Sends one plain-text message from `sendops-check@yourdomain.com` **through your own SES**, the same way your app's mail goes out.
2. Receives it at a SendOps mailbox.
3. Reports what arrived: the domain that signed the message, and whether SPF, DKIM and DMARC passed.

When the check finishes, SendOps re-scores the domain straight away, so the score and tasks reflect the result.


  The check runs against SendOps's own receiver. It shows whether your mail is signed as you and passes authentication. It can't show which folder Gmail or Outlook would put the message in.


## When to run it

Run it once for each sending domain, and again after you change anything about how the domain is signed.

The two biggest checks in the Authentication section, **Receiver verified your DKIM signature** and **Receiver passed DMARC**, can only be measured from an authentication check. Without one, they show as **not measured**, and you'll see a task asking you to run it.

A result counts for **30 days**. After that, the checks go back to not measured until you run it again.

## Limits

- **10 runs a day per domain.** If you hit the limit, SendOps tells you when the next run is allowed.
- **Not available while your SES account is in the sandbox.** A sandboxed account can only send to addresses you've verified, and SendOps's mailbox isn't one of them. [Request production access](/sending-email/ses-production-access) first.
- **Your AWS account must be connected**, because the message is sent from your own SES.
- **It can take up to about 2 minutes** while SendOps waits for the message to arrive.
- Running the check needs permission to manage domain authentication.

The message is a real send, so it counts as one message on your SES account.

## What each result means

| Result | What it means | What to do |
|---|---|---|
| **Signed as your domain** | The message carried a DKIM signature for your own domain. This is what you want. Check the DKIM verdict too: if it says fail, the signature was yours but didn't verify. | Nothing, if DKIM passed. If it failed, the key for that selector isn't published or doesn't match. Check the identity's DKIM status in SES. If you recently (re)verified it, wait for DNS to update and run the check again. |
| **Signed as amazonses.com** | SES signed the message as itself, not as you. Receivers can't tie it to your domain, so a receiver enforcing your DMARC policy can quarantine or reject it. | The app sending this mail uses SES in a region or account where only the address is verified. Verify the domain there, then publish its DKIM records. |
| **Signed by another domain** | The message carried a signature, but not for your domain. | Check which DKIM identity SES signs with for your domain, for example a parent domain or a key you brought yourself (BYODKIM). |
| **Unsigned** | The message arrived with no DKIM signature at all. | Check that DKIM signing is turned on for the identity in SES → Verified identities → your domain → Authentication. |
| **Didn't arrive** | The message didn't arrive within two minutes, so there was nothing to check. | Run the check again. |
| **Send failed** | Your SES didn't send the message, so there was nothing to check. | Check your SES account and the domain's identity in SES, then run the check again. |

The result also lists every DKIM signature on the message, with its domain (`d=`) and selector (`s=`), and the time it ran.

The matching [task](/reports/deliverability-score/tasks) for any problem names the exact signature SendOps saw.

## What's next?

- [Deliverability Score](/reports/deliverability-score): how the result feeds the score.
- [Tasks and where you do them](/reports/deliverability-score/tasks): working through what the check finds.
- [DNS Configuration](/domains/dns-configuration): publishing DKIM records.