{"registry_version":"2026.1025.387","generated_at":"2026-10-25T06:27:00Z","content_sha256":"089d16f627d9365e3d0663cc8069203706d7cb23a76c332226e29686968811a5","signed":true,"signature":{"key_id":"ed25519:74ca19268e364242","algorithm":"ed25519","expires_at":"2026-11-24T06:27:09Z","expired":false,"manifest":"/registry/manifest.json"},"id":"aws/ses-production-access","name":"Amazon SES - verify a domain and leave the sandbox","vendor":"Amazon Web Services","status":"researched","last_verified":null,"last_researched":"2026-10-25","summary":"Verify your sending domain in Amazon SES (three DKIM CNAME records), then ask AWS to move the account out of the SES sandbox for that Region so you can email anyone. AWS reviews each request by hand.","account_model":{"summary":"SES lives inside an AWS account. Sandbox status, identities and sending quotas are separate in every AWS Region, so verify the domain and request production access in each Region you send from.","notes":["Even after leaving the sandbox, every From / Source / Sender / Return-Path identity must be verified."]},"prerequisites":[{"entry":"aws/account-and-iam","note":"An activated AWS account and a non-root user with SES permissions."},{"need":"A domain you control with access to its DNS settings","note":"e.g. the namecheap/dns entry if the domain is at Namecheap."}],"identity_requires":[],"have_ready":[{"kind":"live_website","description":"A live website on the sending domain that shows what the business does.","why":"The request asks for a website URL so AWS can understand the mail you will send.","needed_for":["request-production"],"auto_check":"website_live","source_url":"https://docs.aws.amazon.com/ses/latest/dg/request-production-access.html"},{"kind":"domain_email","description":"Access to the DNS settings of the sending domain (to add three CNAME records).","why":null,"needed_for":["verify-domain"],"auto_check":"dns_record","source_url":"https://docs.aws.amazon.com/ses/latest/dg/creating-identities.html"},{"kind":"other","description":"A written use case: which emails (transactional or marketing), expected volume, how recipients opt in, and how you handle bounces and complaints (e.g. SNS notifications and a suppression list).","why":"Thin descriptions get an automatic denial asking for more detail.","needed_for":["request-production"],"auto_check":"none","source_url":"https://repost.aws/knowledge-center/ses-production-access-request-faq"}],"steps":[{"id":"choose-region","title":"Pick the SES Region you will send from","summary":"Sandbox status and identities are per Region; choose one (for example eu-west-2 London) and stay in it for every step.","route":"guided","gate":"none","human_only":false,"gate_label":null,"depends_on":[],"optional":false,"url":null,"lead_time":null,"preflight":[],"captures":null},{"id":"verify-domain","title":"Create a domain identity and publish the DKIM records","summary":"In SES Identities, create a Domain identity (Easy DKIM, 2048-bit default) and add the three CNAME records SES shows at your DNS host. If the domain is in Route 53 in the same account SES can publish them for you.","route":"copilot","gate":"human_submit","human_only":true,"gate_label":"You press submit","depends_on":["choose-region"],"optional":false,"url":"https://console.aws.amazon.com/ses/","lead_time":{"official":{"text":"DNS changes can take up to 72 hours to propagate; the identity shows Verified once SES sees all DKIM records.","source_url":"https://docs.aws.amazon.com/ses/latest/dg/creating-identities.html","source_title":"Creating and verifying identities in Amazon SES"},"reported":null,"typical_minutes":null},"preflight":["domain_has_mx"],"captures":null},{"id":"request-production","title":"Request production access","summary":"From Account dashboard > Get set up > Request production access, choose Transactional or Marketing, enter your website URL, up to 4 contact emails and language, tick the acknowledgement about opt-in and bounce/complaint handling, and press Submit yourself.","route":"copilot","gate":"human_submit","human_only":true,"gate_label":"You press submit","depends_on":["verify-domain"],"optional":false,"url":"https://console.aws.amazon.com/ses/","lead_time":null,"preflight":["website_live","website_not_form_only","domain_email_matches_website"],"captures":null},{"id":"review","title":"Wait for AWS review","summary":"AWS Support reviews the request; you cannot edit it while under review. Answer any follow-up questions on the support case.","route":"guided","gate":"third_party_review","human_only":true,"gate_label":"The provider reviews it","depends_on":["request-production"],"optional":false,"url":null,"lead_time":{"official":{"text":"Initial response within 96 hours; longer if AWS needs more information.","source_url":"https://docs.aws.amazon.com/ses/latest/dg/request-production-access.html","source_title":"Request production access (Moving out of the Amazon SES sandbox)"},"reported":{"text":"Some developers report denials with no reason and re-reviews that repeat the denial.","source_url":"https://repost.aws/questions/QU-0FO4B5DTVqc-drZUifG_Q/ses-production-access-denied-for-no-stated-reason","source_title":"re:Post question - SES production access denied for no stated reason"},"typical_minutes":null},"preflight":[],"captures":null}],"gates":[{"step":"verify-domain","gate":"human_submit","label":"You press submit"},{"step":"request-production","gate":"human_submit","label":"You press submit"},{"step":"review","gate":"third_party_review","label":"The provider reviews it"}],"lead_times":[{"step":"verify-domain","what":"Create a domain identity and publish the DKIM records","official":{"text":"DNS changes can take up to 72 hours to propagate; the identity shows Verified once SES sees all DKIM records.","source_url":"https://docs.aws.amazon.com/ses/latest/dg/creating-identities.html","source_title":"Creating and verifying identities in Amazon SES"},"reported":null},{"step":"review","what":"Wait for AWS review","official":{"text":"Initial response within 96 hours; longer if AWS needs more information.","source_url":"https://docs.aws.amazon.com/ses/latest/dg/request-production-access.html","source_title":"Request production access (Moving out of the Amazon SES sandbox)"},"reported":{"text":"Some developers report denials with no reason and re-reviews that repeat the denial.","source_url":"https://repost.aws/questions/QU-0FO4B5DTVqc-drZUifG_Q/ses-production-access-denied-for-no-stated-reason","source_title":"re:Post question - SES production access denied for no stated reason"}}],"outputs":[{"name":"SES_REGION","description":"AWS Region where the SES account is out of the sandbox.","secret":false,"example_format":"eu-west-2","environments":null},{"name":"SES_FROM_ADDRESS","description":"Verified sender address on the verified domain.","secret":false,"example_format":"no-reply@yourdomain.com","environments":null}],"renewals":[],"estimated_minutes":null,"guide_url":"https://verapli.com/guides/aws/ses-production-access"}