Only send to people who asked
The request makes you confirm you only email people who explicitly asked for it and handle bounces and complaints; the AWS AUP bans unsolicited mass email. Plain-English summary, not legal advice. [1]
Guides · email · Verification-gated
Amazon SES - verify a domain and leave the sandbox
Verify your sending domain in Amazon SES (three DKIM CNAME records), then ask AWS to move the account out of the SES sandbox for that Region so you can email anyone. AWS reviews each request by hand.
Researched · not yet run liveLast researched 25 October 2026 · Amazon Web Services · provider site
Researched, not yet run live. Built from the provider’s official pages (linked below). A person hasn’t walked this flow end to end yet, so check each step against the source.
Who owns what
SES lives inside an AWS account. Sandbox status, identities and sending quotas are separate in every AWS Region, so verify the domain and request production access in each Region you send from.
Even after leaving the sandbox, every From / Source / Sender / Return-Path identity must be verified.
Have ready
- aws/account-and-iam: An activated AWS account and a non-root user with SES permissions.
- A domain you control with access to its DNS settings: e.g. the namecheap/dns entry if the domain is at Namecheap.
- A live website on the sending domain that shows what the business does. · The request asks for a website URL so AWS can understand the mail you will send. [1]Needed for: Request production access
- Access to the DNS settings of the sending domain (to add three CNAME records). [2]Needed for: Create a domain identity and publish the DKIM records
- A written use case: which emails (transactional or marketing), expected volume, how recipients opt in, and how you handle bounces and complaints (e.g. SNS notifications and a suppression list). · Thin descriptions get an automatic denial asking for more detail. [4]Needed for: Request production access
Steps
Steps marked “human step” are ones only you can do: verapli never signs in, submits, pays or accepts terms for you.
Pick the SES Region you will send from
Sandbox status and identities are per Region; choose one (for example eu-west-2 London) and stay in it for every step.
Create a domain identity and publish the DKIM records
In SES Identities, create a Domain identity (Easy DKIM, 2048-bit default) and add the three CNAME records SES shows at your DNS host. If the domain is in Route 53 in the same account SES can publish them for you.
- The provider says
- DNS changes can take up to 72 hours to propagate; the identity shows Verified once SES sees all DKIM records. [2]
If something goes wrong (2)
- Domain still not verified after 72 hours.: Check the records are in the right fields, that your DNS host did not append the domain to the Name (remove it or end the value with a dot), that the underscore in _domainkey is present, and that the records are for this Region. [2]
- Verification email for an email-address identity expired.: The link lasts 24 hours; choose Resend on the identity page. [2]
Where: https://console.aws.amazon.com/ses/
Request production access
From Account dashboard > Get set up > Request production access, choose Transactional or Marketing, enter your website URL, up to 4 contact emails and language, tick the acknowledgement about opt-in and bounce/complaint handling, and press Submit yourself.
Where: https://console.aws.amazon.com/ses/
Wait for AWS review
AWS Support reviews the request; you cannot edit it while under review. Answer any follow-up questions on the support case.
- The provider says
- Initial response within 96 hours; longer if AWS needs more information. [1]
- People report
- Some developers report denials with no reason and re-reviews that repeat the denial. [5]
If something goes wrong (2)
- Automatic denial asking for more details.: Reply on the same support case with a detailed use case (mail types, volume, list source, opt-in, bounce/complaint handling). [4]
- Denied with no specific reason.: AWS does not share reasons and Support cannot overturn them. Improve the basics (business domain with SPF/DKIM/ DMARC, a real website, a specific use case) and ask for reconsideration on the case. [6]
What you end up with
| Env var | Secret | Format | What it is |
|---|---|---|---|
SES_REGION | not secret | eu-west-2 | AWS Region where the SES account is out of the sandbox. |
SES_FROM_ADDRESS | not secret | no-reply@yourdomain.com | Verified sender address on the verified domain. |
Pricing
- Free tier: New AWS customers can apply AWS Free Tier credits (up to $200) to SES.
- Costs: $0.10 per 1,000 outbound emails on a la carte pricing; dedicated IPs $24.95 per IP per month.
Source [3]
For agents
The same entry as JSON: /api/v1/entries/aws/ses-production-access · requirements /api/v1/requirements/aws/ses-production-access · terms /api/v1/terms/aws/ses-production-access.
Remote MCP (read-only, no auth)
claude mcp add --transport http verapli https://verapli.com/mcp
> "What do I need for Amazon SES - verify a domain and leave the sandbox, and how long will it take?"
→ tools/call requirements { "provider_id": "aws/ses-production-access" }Sources
- Request production access (Moving out of the Amazon SES sandbox) Sandbox limits (verified recipients only, 200 messages per 24 hours, 1 message per second, per Region); request fields (Marketing or Transactional, website URL, up to 4 additional contacts, English/Japanese, acknowledgement about opt-in and bounce/complaint handling); verifying a domain first helps approval; cannot edit while under review; initial response within 96 hours, longer if more information needed; CLI put-account-details. · accessed 25 October 2026 · official
- Creating and verifying identities in Amazon SES Domain identity with Easy DKIM publishes three CNAME records; DNS changes can take up to 72 hours; troubleshooting (host field, provider auto-appending domain, underscores, per-Region records); email verification link expires after 24 hours; identities are per Region; 10,000 identities per Region. · accessed 25 October 2026 · official
- Amazon SES pricing $0.10 per 1,000 outbound emails (a la carte); dedicated IP $24.95/month; new customers can use AWS Free Tier credits. · accessed 25 October 2026 · official
- AWS re:Post Knowledge Center - SES production access request FAQ AWS does not share specific denial reasons; Support cannot see or overturn them; requests with too little use-case detail get an automatic denial asking for more detail - reply on the case. Seen via search summary; direct fetch returned 403. · accessed 25 October 2026 · official
- re:Post question - SES production access denied for no stated reason Developers report denials with no reason given and re-reviews with the same answer. · accessed 25 October 2026 · community
- re:Post question - SES production access request denied, need guidance Answers advise a business domain with proper DNS records and a detailed use case (email types, volume, list source, bounce handling). · accessed 25 October 2026 · community
- AWS Acceptable Use Policy Prohibits distributing unsolicited mass email; AWS may disable violating resources. · accessed 25 October 2026 · official
Provider rules change. This page is generated from verapli registry version 2026.1025.387; spotted something out of date? Tell us. Amazon Web Services is not affiliated with verapli.