The US Air Force has said it is investigating its apparent failure to enter information about Texas gunman Devin Patrick Kelley's criminal history into the national database.
Ex-airman Kelly was court-martialled for domestic violence in 2012, and was barred from owning or buying guns.
But last year he was able to purchase a rifle he used in Sunday's attack on a small church outside San Antonio.
He killed 26 people and fled the scene. He was later found dead in his car.
Police said he died from what appeared to be a self-inflicted gunshot wound after being chased by armed bystanders.
Kelley was also shot in his leg and torso by a citizen, the regional director for the Texas Department of Public Safety, Freeman Martin, was quoted as saying by the Associated Press.
In a statement, the Air Force said: "Initial information indicates that [Devin] Kelley's domestic violence offense was not entered into the National Criminal Information Center database by the Holloman Air Force Base Office of Special Investigations."
It said it was now - together with the Department of Defense - investigating the handling of Kelley's criminal records.
Texas Governor Greg Abbott earlier said Kelley, 26, should not legally have been allowed to own a firearm, after having been denied a gun owner's permit by the state.
Kelley bought the rifle from the Academy Sports + Outdoors shop in San Antonio. The store issued a statement sending "deep condolences" to the victims' families.
Mother-in-law argument
Kelley was armed with the semi-automatic rifle and two pistols when he attacked the First Baptist Church of Sutherland Springs during Sunday services.
He had argued with his mother-in-law before the rampage, officials said.
Kelley called his father after he was shot by an armed bystander and said he did not think he would survive.
"This was not racially motivated, it wasn't over religious beliefs," said Mr Martin.
"There was a domestic situation going on with the family and in-laws," he said, adding that Kelley had sent threatening texts to his mother-in-law.
"We know that he expressed anger towards his mother-in-law, who attends this church," Mr Martin added.
On Monday evening, a vigil was held in Sutherland Springs.
In one corner of the field, music played, people prayed, and hundreds of people held their hands in the air, the BBC's Owen Amos reports. In another, a floodlight illuminated 26 crosses - one for each person shot dead.
Standing at the back, a feather in his cowboy hat, was Johnnie Langendorff - one of two men who chased the shooter out of town.
People queued to shake Mr Langendorff's hand. At one point, a couple embraced him, and they stood in prayer for two or three minutes, our correspondent says.
Who were the victims?
Wilson County Sheriff Joe Tackitt said between 12 and 14 children were among those killed in the attack in Sutherland Springs, a small town 30 miles (50km) south-east of the city of San Antonio.
The youngest of those who died was only a year old.
As many as eight members of the Holcombe family were killed in the shooting, the Washington Post reported.
The BBC spoke to the Holcombes' neighbour Pauline Garza, who said the family did not come back from church.
The First Baptist Church's pastor, Frank Pomeroy, told US media his 14-year-old daughter, Annabelle, was among those killed.
Twenty people were also wounded.
Who was the gunman?
Kelley was court-martialled in 2012 after he was accused of assault against his wife and step-son. He was sentenced to 12 months' confinement.
He received a "bad conduct" discharge two years later, according to Ann Stefanek, a US Air Force spokeswoman.
Gov Abbott said: "It's clear this is a person who had violent tendencies, who had some challenges, and someone who was a powder keg, seeming waiting to go off."
Kelley worked till last July as a security guard for an amusement park run by the Schlitterbahn company in New Braunfels near Sutherland Springs.
His employment was "terminated" after just over five weeks, the company said.
He had a licence to work as an unarmed security guard, a job that police described as "similar to a security guard at a concert-type situation".
"There were no disqualifiers entered into the national crime information database to preclude him from receiving a private security licence," police said.
The shooting comes just a month after a gunman in Las Vegas opened fire on an outdoor music festival, killing 58 people and wounding hundreds in the deadliest mass shooting in recent US history.