Sending email from Amazon SES is easy. Maintaining your sender reputation is what decides whether your emails arrive. SES measures two things: bounces (emails to addresses that do not exist or reject the message) and complaints (recipients who click "this is spam"). If either rate climbs too high, AWS first warns you and then can pause sending for the account. It is not an empty threat: it happens, and it happens at the worst possible moment.
The defence is simple to describe: find out about every bounce and every complaint, and never write to those addresses again. This guide sets up exactly that.
Before you start: what each thing means
- SES
- Simple Email Service, Amazon's service for your applications to send email.
- Reputation
- The "score" your domain and your account have as senders. It depends on how many emails bounce and how many are marked as spam. If it drops, emails go to spam or AWS slows you down.
- Bounce
- An email that could not be delivered. Permanent: the address does not exist. Transient: the mailbox is full or the server is not responding right now.
- Complaint
- When the recipient marks your email as spam and their provider reports it to Amazon.
- Suppression list
- The list of addresses SES no longer sends to because they bounced or complained. Amazon maintains it for you.
- SNS
- Simple Notification Service, Amazon's notification service: it receives a message and distributes it to whoever is subscribed (an email address, an application...).
- SNS topic
- A "channel" within SNS. SES sends every bounce or complaint there, and you subscribe to receive them.
- Subscription
- The way someone receives a topic's messages: by email, or by having them sent to a web address of your application.
- Configuration set
- An advanced SES option for applying settings (like these notifications) only to certain emails.
- JSON
- A text format for data, easy for programs to read. Notifications arrive in it.
Step by step
Check the account suppression list
In the SES console, Configuration, Suppression list tab. It is a list SES keeps for you: when an address bounces permanently or complains, it goes on the list and SES stops sending to it even if your application tries. Make sure it is enabled for bounces and complaints. New accounts come that way; older accounts may have it switched off.
From that screen you can search for an address, see why it was added and remove it if it was a mistake (a full mailbox that has since been emptied, for example).
Create an SNS topic for the notifications
In Amazon SNS, Topics, Create topic, type Standard, name
ses-rebotes-quejas. Inside the topic, Create subscription: to begin with, protocol Email with an address you read; confirm the subscription from the email you receive. Later on you can add a second HTTPS subscription pointing at your application, so that it processes the notifications on its own.Connect the SES identity to the topic
SES, Identities, open your domain, Notifications tab. Under Feedback notifications click Edit and assign the SNS topic to Bounces and Complaints (Deliveries are optional and generate a lot of noise). Tick Include original email headers: that way you will know exactly which email bounced. Save.
If you use configuration sets in your sending, you can do the same from the set, with an SNS event destination; it is more flexible because it allows different destinations per type of email.
Decide what happens with email forwarding
By default, SES forwards every bounce to the sender by email. As soon as the SNS topic is working, disable email feedback forwarding on the same tab, so you do not receive it twice and do not fill a mailbox nobody checks.
Process the notifications in your application
Each notification is a JSON with the type (
BounceorComplaint), the affected addresses and, for bounces, whether it is permanent (the address does not exist) or transient (full mailbox, server down). The practical rule: on a permanent bounce or a complaint, flag the recipient in your database so you never send to them again and, if they are a customer, let them know through another channel. On a transient one, retry later and, if it repeats several times, treat it as permanent.Keep an eye on the rates
In SES, Account dashboard, reputation block: you will see the bounce rate and the complaint rate, with the thresholds above which AWS reviews the account. Look at it once a week. If one day you see the rate jump suddenly, stop bulk sending until you understand why: an old list, a form that accepts made-up addresses, an email that looks like spam.
What can go wrong
I am not receiving the notifications
The email subscription has to be confirmed (the status in SNS must be "Confirmed", not "Pending"). And the sending identity must be the one with the topic assigned: if you send from a verified address separate from the domain, configure its notifications too.
I get a lot of bounces from mailboxes that do exist
Look at the bounce code inside the notification. If the receiving server is rejecting you for reputation or lack of authentication, the problem is not the addresses: review DKIM, SPF and DMARC (guide in this section) and the content of the email.
A valid address is on the suppression list
You can remove it from the console or with the corresponding command of the command-line tool. If it goes back on, it is still bouncing; do not remove it a third time.
AWS has put my account "under review"
Read the email from AWS: they tell you which rate has been exceeded and ask you for a plan. Reply in the support case explaining the cause and what you have changed (list cleaned, notifications processed, automatic unsubscribe). With a concrete, prompt reply the review usually ends well.
In Simplio
In Simplio the Email (SES) screen shows per region the quota, what has been sent, the bounce and complaint rates and the suppression list with its reasons, for all your AWS accounts at once. If the bounce rate climbs too high, it warns you by email before AWS takes action. Without opening the SES console or the SNS one.
The same task, in AWS and in Simplio
| In the AWS console | In Simplio | |
|---|---|---|
| See bounces and complaints | SES, Account dashboard, region by region | Rates for all accounts and regions on one screen |
| Find out in time | Create SNS topic, subscribe, confirm, connect the identity: 5 steps, 25 minutes | Notice by email when the rate climbs, with nothing to configure |
| Suppression list | Search address by address in SES | Searchable list with reasons |