Every new Amazon SES account starts in the sandbox, a test mode designed so that nobody can use a freshly created account to send spam. In the sandbox you can only send email to addresses you have verified beforehand in SES, and on top of that with a very low daily quota and sending rate. For a real application, which has to write to customers you do not know in advance, you have to ask AWS to take you out of the sandbox, what they call "production access".
It is a request that a person at AWS reviews, and they approve or reject it depending on what you tell them. This guide is about telling it well.
Before you start: what each thing means
- SES
- Simple Email Service, Amazon's service for your applications to send email.
- Sandbox
- The test mode every SES account starts in. It only lets you send to addresses you have verified, with a low daily cap.
- Production access
- What AWS calls getting out of the sandbox: the account can send email to anyone, with normal quotas.
- Verified identity
- A domain or email address you have proven to Amazon is yours. To request leaving the sandbox you should have the domain verified.
- Bounce
- An email that could not be delivered, usually because the address does not exist.
- Complaint
- When a recipient marks your email as spam. Amazon cares a great deal that there are very few.
- Suppression list
- A list SES maintains with the addresses that have bounced or complained, so it does not send to them again even if your application tries.
- SNS
- Simple Notification Service, Amazon's notification service. SES can send it every bounce or complaint so that you find out.
- Transactional versus marketing
- Transactional: emails the user expects because they did something (an order, a sign-up). Marketing: newsletters and promotions. AWS asks which one yours is.
Step by step
Check which region you are in the sandbox in
The sandbox is per region. Open the SES console in the region your application sends from and look at the Account dashboard: at the top you will see a notice that the account is in the sandbox, with the current quota and rate. If you use two regions, you will have to request it in both.
Have your domain verified and authenticated
Before requesting anything, your sending domain must be verified in SES with DKIM enabled, and you should have SPF and DMARC in the DNS (explained in the previous guide). AWS does not strictly require it, but the reviewer sees an unauthenticated domain as a bad sign, and without it your email will go to spam as soon as you are out anyway.
Prepare how you handle bounces and complaints
This is what AWS values most. You have to be able to explain what your system does when an email bounces (the address does not exist) or when someone marks it as spam (a complaint). The minimum acceptable answer: you have the SES account-level suppression list enabled (under Configuration; it is on by default in new accounts) so you do not resend to addresses that bounce, and you receive bounce and complaint notifications, for example with an Amazon SNS topic attached to the identity. Better still if your application reads those notifications and flags the recipient so it never writes to them again.
If you send newsletters or marketing, you also need an unsubscribe link in every email that actually works.
Open the production access request
In the SES Account dashboard, click Request production access (or "View account details" and then the request button). A form opens with these fields:
- Mail type: Transactional (confirmations, invoices, notices to registered users) or Marketing. Choose the one that truly applies; if you do both, explain it in the description.
- Website URL: your company's or application's website, which must exist and explain what you do.
- Use case description: the important field. We cover it in the next step.
- Contact language and the box accepting the terms.
Write a description that answers what they are going to ask
Imagine it is read by someone who sees a hundred requests a day and is looking for reasons to reject. Answer, in a few concrete sentences, these questions: what you send (for example "order confirmations and shipping notices to customers who have bought in our shop"); to whom and how they gave you their address ("registered customers who agreed to receive notices when buying"); how much you expect to send per day and how many distinct recipients; how you handle bounces and complaints (step 3, naming things: suppression list, SNS notifications, automatic unsubscribe); and how they can stop receiving email. If you have an example of the email you send, describe it. The less the reader has to assume, the better.
Avoid vague sentences like "we need to send emails to our users". It is the fastest way to get asked for more information.
Submit and wait for the reply
AWS replies by email and in the support centre, usually within a day. If they approve, the Account dashboard stops showing the sandbox notice and your new daily quota appears, which will grow on its own as you send with few bounces. If they ask for more information, reply in the same case with the missing details; do not open another one.
What can go wrong
My request was rejected
Read the reason: it is almost always a lack of detail about bounces, complaints and unsubscribes, or a website that does not explain the business. Fix what they ask for and request again from the same support case, answering point by point. A rejection is not final.
I am out of the sandbox but still cannot send to new addresses
Check the region: you requested it in one and your application sends from another. Approval does not extend to the other regions.
The daily quota is not enough for me
Quotas go up on their own if your history is good. If you need a big jump by a specific date, open a "service limit increase" support case for SES explaining the reason and the date, well in advance.
After getting out, complaints start coming in
Keep the complaint and bounce rates low; SES has thresholds above which it warns you and, if you do not improve, it can pause sending for the account. Watch the reputation dashboard and remove problem addresses as soon as they appear.
In Simplio
In Simplio the Email (SES) screen shows you whether each region is in the sandbox, the daily quota, what has been sent, the bounce and complaint rates and the suppression list. And you can request to leave the sandbox from Simplio itself, with a form that already guides you on what to say. If the bounce rate climbs too high, it warns you before AWS does.
The same task, in AWS and in Simplio
| In the AWS console | In Simplio | |
|---|---|---|
| Request to leave | SES console, blank form, knowing what AWS wants to hear | Form from Simplio that guides you field by field |
| Know which regions are still in the sandbox | Open SES region by region | A list with the status of each region and each account |
| After leaving | Watch the reputation dashboard by hand | Notice by email if bounces or complaints rise |