Email address is not verified (AWS SES)

Question

I want to use Amazon's Simple Email Service to send emails.

I verified my domain as well as the email address I want to send from.

For both it says verified.

Now when I use the Send Test Email from the AWS Console to send a test email to myemail@outlook.com, I only get the error message:

Email address is not verified. The following identities failed the check in region EU-WEST-1: myemail@outlook.com (Request ID: 9fb78de1-2673-11e6-bbbc-5f819fabe4f4)

Now it strikes me because it says myemail@outlook.com was not verified but I tried to send from admin@mydomain.example. The Send Test Email Dialog even forces you to use an email which already is registered.

How can this issue be resolved? Did I miss anything?

You can only send mail to verified email addresses and domains, or to the Amazon SES mailbox simulator. https://docs.aws.amazon.com/ses/latest/dg/send-an-email-from-console.html#send-email-simulator — Hamdi Yilmaz, Mar 11 '23 at 16:27

score 444 · Accepted Answer · answered May 30 '16 at 15:11

444

When your SES account is in "sandbox" mode, you can:

Only send from verified domains and email addressed, and
Only send to verified domains and email addresses

In order to send to anyone else, you must move your account out of sandbox mode by contacting AWS support and requesting it:

https://docs.aws.amazon.com/console/ses/sandbox

answered May 30 '16 at 15:11

Matt Houser

33,983
6
70
88

1

More details: https://docs.aws.amazon.com/ses/latest/DeveloperGuide/request-production-access.html – fregante Oct 11 '16 at 13:39
8

You could also add the target email address to verified email addresses from the SES console. Then it lets you send a test mail to that address. – yem yem yen Mar 17 '17 at 03:03
213

guess it was too much to ask that the error message say anything along these lines – mattacular Jun 14 '18 at 20:43
5

In my case everything was verified and still got this (confusing) error message, until I realised the request was made with the wrong IAM user. Worth checking, too. – Nick Dec 09 '18 at 17:41
2

for testing purposes, verify emails like this: docs.aws.amazon.com/ses/latest/DeveloperGuide/… and you must EITHER add a TXT record to the DNS for the domain you want to verify, OR add addresses one by one using a verification code that gets sent to that address. ALSO note the verifications are PER region, so choose the region you want to test sending FROM before verifying too many, ...hrm..... (^-^) – Simon B. May 28 '19 at 13:40
Is there any downside to asking to coming out of the SandBox on Day 1? In other words, any advantage to stay in the sandbox, if your security is setup properly. – NealWalters Oct 05 '20 at 20:57
1

AWS SES is not simple. Sandbox is not needed for most people. I don't know why aws sets the idea of sandbox. I don't like the idea. I haven't understood what sandbox is. – Super Kai - Kazuya Ito Jun 07 '21 at 12:09
1

its still to much to ask in 2022 for the error message to be more useful (TO email also needs to be verified in sandbox) – Pierre Sep 01 '22 at 03:38

score 34 · Answer 2 · answered Jul 16 '20 at 23:29

34

In my case I needed to verify the email again in the region where it failed. You can try to change your region in the top right then you have click again "Verify a New Email Address"

answered Jul 16 '20 at 23:29

coyr

659
6
9

5

the screenshot is now outdated, probably you mean: 'Verified identities' – Greg Wozniak Mar 01 '22 at 20:28

score 12 · Answer 3 · answered Oct 09 '17 at 04:31

12

If the email is already verified and you're out of the SES Sandbox, check that you've the correct AWS region for the SMTP server. I was trying to connect to email-smtp.eu-west-1.amazonaws.com when my SMTP credential was for the email-smtp.us-east-1.amazonaws.com server.

answered Oct 09 '17 at 04:31

georgiecasey

21,793
11
65
74

Incorrect, I contacted AWS support and they said that by default, all the accounts that are created are in SandBox mode. You need to contact AWS support, file a new ticket and they will remove the sandbox environment provided you have a valid domain. – pass-by-ref Nov 21 '17 at 23:34
2

yes, i said as long as you're out of the SES sandbox, you still need to use the correct AWS region. – georgiecasey Nov 21 '17 at 23:54
Thanks! This worked for me. For some reason the server name changed when I moved out of sandbox without me noticing. – Ikbel May 15 '18 at 16:48
@georgiecasey Suppose my EC2 is in singapore. Then I can't use the `SES` because I am not in the Virginia or Ireland? – joe Feb 05 '19 at 07:32
@Sarit no, you can still use SES, you just need to use the Asia Pacific region. Or you did anyway when I posted my answer! – georgiecasey Feb 05 '19 at 09:06
@georgiecasey Unfortunately. No Asia Pacific region. Then my EC2 can't use it. – joe Feb 06 '19 at 11:06
Is this required even if we get out of the sandbox mode? – SalahAdDin May 11 '21 at 13:06

score 6 · Answer 4 · answered Jun 02 '20 at 07:58

6

@Matt Houser has already answered the questions but I am adding a screenshot from June, 2020 that explains what he said.

answered Jun 02 '20 at 07:58

bhordupur

872
13
14

score 4 · Answer 5 · answered Aug 30 '20 at 03:34

4

Make sure

You add your email to ses and get verified.
You enable the Production mode for your account.

answered Aug 30 '20 at 03:34

Feng Liu

954
13
22

score 2 · Answer 6 · answered Jun 10 '21 at 14:40

2

Make sure

-You have submitted your case request to support customer and explain in what purposes confirm it for to 24 maybe they will ask you about some additional information about your application

answered Jun 10 '21 at 14:40

Mezen sboui

31
2

score 2 · Answer 7 · answered Nov 20 '21 at 07:57

I had this issue. I verified domain and email, even the DKIM settings was verified. But still getting this message :

Email address is not verified. The following identities failed the check in region {aws_region}: {email}

I added SourceArn as parameter for sendEmail than get this message :

User `arn:aws:iam::{account_id}:user/{username}' is not authorized to perform `ses:SendEmail' on resource `arn:aws:ses:{aws_region:{account_id}:identity/{email}'

After 2 days I found out the I was using wrong IAM user !

Thanks! Sometimes we forget the simple steps. I recommend check if the IAM user credential has the right credentials. — renanrider, Oct 12 '22 at 13:26

score 2 · Answer 8 · answered Dec 13 '21 at 17:23

2

I had verified an email address, and then a few days later my domain. When the domain was fully verified (inc DKIM) I was still getting the 'Email address is not verified' error when trying to send emails to email addresses within my domain, that weren't my specific verified address.

I deleted my verified email address, and re-verified it, and it worked immediately. I could then send domain wide emails, whereas before - I could only send to and from the email I had previously verified.

answered Dec 13 '21 at 17:23

omeanwell

1,847
1
10
16

I have a grandfathered (pre DKIM) approved domain and email address. I'm setting up a new domain and email address. All the code and keys and everything else are identical and I'm getting this error. I feel like this post comes closest to likely being the issue. I'm going to check after every 6 hours or so, and if it doesn't work, i will delete and re-provision the email. If it instantly works, I will upvote this post as the solution. More to come. – AppDreamer Apr 12 '22 at 23:43

score 2 · Answer 9 · answered Jan 27 '22 at 22:14

2

Be aware the Verified Identities are actually case sensitive. I was wondering why I got such error, even though my email was verified and out of SandBox.

answered Jan 27 '22 at 22:14

toadead

1,038
16
29

israteneda · Answer 10 · 2023-07-13T17:47:42.563

In my case, I wanted to email to the same verify email address. So, I verified my email by DKIM as @Greg Wozniak mentioned. I saw the field tick green and verified:

But I was still seeing:

Email address is not verified. The following identities failed the check in region...

The solution in my case was to add this function in the code:

def verify_email_identity():
    ses_client = boto3.client("ses", region_name="us-east-1")
    response = ses_client.verify_email_identity(
        # Email address that will receive the email 
        # In my case the same email address 
        # that was verified on Amazon SES
        EmailAddress="receipientemail@gmail.com"
    )
    print(response)

Taken from this website

So, I received a new email to verify the recipient email address. After verify the recipient email address by clicking on the link sent by Amazon SES. I was able to send the email with this code:

client = boto3.client('ses',region_name="us-east-1")
# Try to send the email.
try:
    #Provide the contents of the email.
    response = client.send_email(
        Destination={
            'ToAddresses': [
                receipientemail@gmail.com,
            ],
        },
        Message={
            'Body': {
                'Html': {
                    'Charset': "UTF-8",
                    'Data': "Test",
                },
            },
            'Subject': {
                'Charset': "UTF-8",
                'Data': "Test",
            },
        },
        Source=receipientemail@gmail.com,
    )
# Display an error if something goes wrong. 
except ClientError as e:
    print(e.response['Error']['Message'])
else:
    print("Email sent! Message ID:"),
    print(response['MessageId'])

this is like a couple-levels-deep-into-hell type of debugging — serraosays, Jul 19 '22 at 17:51
Sorry @serraosays I didn't get the meaning of couple-levels-deep-into-hell, is it the answer wrong? — israteneda, Jul 20 '22 at 00:57
No, just impressed by how thorough your answer is. Somewhat disappointed at how bad AWS SES is at surfacing these problems. I'm dealing with something similar rn. — serraosays, Jul 20 '22 at 13:31
This was very helpful! Thank you so much! SES error messages and docs leave a lot to be desired. — Ryan, Jul 13 '23 at 16:40

score 2 · Answer 11 · answered Nov 09 '22 at 15:31

2

For me the issue was that I was mismatching cases. The verified email and the email sent have to match exactly.

test@gmail.com vs Test@gmail.com

answered Nov 09 '22 at 15:31

thesillyhome dev

21
1

score 1 · Answer 12 · edited Dec 17 '21 at 12:51

I was having the same issue a couple minutes ago, although this time I'm working with the SDK in PHP.

I had to double check the SesClient instantiation code.

$SesClient = new SesClient([
    'profile' => 'default',
    'version' => '2010-12-01',
    'region'  => 'us-west-2',

]);

I discovered that the region in the instantiation code is us-west-2. I went back to my console and discovered that SES account was sandboxed in us-east-2 (Ohio).

I implemented the change in the instantiation code like so

$SesClient = new SesClient([
    'profile' => 'default',
    'version' => '2010-12-01',
    'region'  => 'us-east-2',

]);

It's working now.

score 1 · Answer 13 · answered Mar 02 '22 at 10:00

Problem

Confusion comes from the fact that your e-mail address shows as "Verified" in AWS SES -> Verified identities and still not working.

In fact, there are two verification:

DKIM one (which makes the field tick green and verified)
E-mail address verification

That means you must use the e-mail address which you have access to (mailbox) in order to click in the verification link.

Without clicking the link in the e-mail, your identity may be verified but you'll still see the error everywhere.

Simple solution using AWS WorkMail

I am using AWS WorkMail but I've created a new Group instead of another WorkMail account, then added my personal account to it, received a verification e-mail and managed to get: "noreply@..." working.

score 1 · Answer 14 · answered Jul 17 '23 at 08:11

1

Since you are in Sandbox mode, you can add and verify email: "myemail@outlook.com" for temporary workout. Otherwise you need to move from production account to sandbox account.

answered Jul 17 '23 at 08:11

Vraj Bhatt

174
7

score 0 · Answer 15 · answered Apr 02 '22 at 14:18

I had this issue and none of the above worked for me. My issue related specifically to sending via python using boro3. I eventually figured out that the system I was working on had a different set of aws credentials stored in the windows system than it did on the Linux subsystem on the same windows machine. The solution was to set both sets of aws credentials to match the appropriate aws account. I add this here just in case anyone has the same issue and, like me, couldn't find an answer.

score 0 · Answer 16 · edited Aug 30 '23 at 17:24

0

I had the same problem; after reading this document, I realized some parameters were missing.

If you are using boto3 you should send ReturnPathArn and SourceArn too in send_email, that worked for me.

edited Aug 30 '23 at 17:24

d1sh4

1,710
5
21

answered Aug 23 '23 at 11:49

Aya Albehery

1

Email address is not verified (AWS SES)

16 Answers16

Problem

Simple solution using AWS WorkMail

Linked