Email address is not verified (AWS SES)

Question

I want to use Amazon's Simple Email Service to send emails.

I verified my domain as well as the email address I want to send from.

For both it says verified.

Now when I use the Send Test Email from the AWS Console to send a test email to [email protected], I only get the error message:

Email address is not verified. The following identities failed the check in region EU-WEST-1: [email protected] (Request ID: 9fb78de1-2673-11e6-bbbc-5f819fabe4f4)

Now it strikes me because it says [email protected] was not verified but I tried to send from [email protected]. The Send Test Email Dialog even forces you to use an email which already is registered.

How can this issue be resolved? Did I miss anything?

Jugum

You can only send mail to verified email addresses and domains, or to the Amazon SES mailbox simulator. docs.aws.amazon.com/ses/latest/dg/… – Merkley

Answer 1

When your SES account is in "sandbox" mode, you can:

1. Only send from verified domains and email addressed, and
2. Only send to verified domains and email addresses

In order to send to anyone else, you must move your account out of sandbox mode by contacting AWS support and requesting it:

https://docs.aws.amazon.com/console/ses/sandbox

Poona

More details: docs.aws.amazon.com/ses/latest/DeveloperGuide/… – Jumbuck

You could also add the target email address to verified email addresses from the SES console. Then it lets you send a test mail to that address. – Shack

guess it was too much to ask that the error message say anything along these lines – Gismo

In my case everything was verified and still got this (confusing) error message, until I realised the request was made with the wrong IAM user. Worth checking, too. – Macrophage

for testing purposes, verify emails like this: docs.aws.amazon.com/ses/latest/DeveloperGuide/… and you must EITHER add a TXT record to the DNS for the domain you want to verify, OR add addresses one by one using a verification code that gets sent to that address. ALSO note the verifications are PER region, so choose the region you want to test sending FROM before verifying too many, ...hrm..... (^-^) – Edana

Is there any downside to asking to coming out of the SandBox on Day 1? In other words, any advantage to stay in the sandbox, if your security is setup properly. – Afebrile

AWS SES is not simple. Sandbox is not needed for most people. I don't know why aws sets the idea of sandbox. I don't like the idea. I haven't understood what sandbox is. – Purveyor

its still to much to ask in 2022 for the error message to be more useful (TO email also needs to be verified in sandbox) – Stephanus

note that it also seems you cannot use the same recipient and sender even if verified or you will get this error, i was doing this for testing and was able to resolve when adding another verified address to send to, no change to the sender verification (was already verified) – Halfdan

Answer 2

In my case I needed to verify the email again in the region where it failed. You can try to change your region in the top right then you have click again "Verify a New Email Address"

Wetzell

the screenshot is now outdated, probably you mean: 'Verified identities' – Christiachristian

Answer 3

If the email is already verified and you're out of the SES Sandbox, check that you've the correct AWS region for the SMTP server. I was trying to connect to email-smtp.eu-west-1.amazonaws.com when my SMTP credential was for the email-smtp.us-east-1.amazonaws.com server.

Default

Incorrect, I contacted AWS support and they said that by default, all the accounts that are created are in SandBox mode. You need to contact AWS support, file a new ticket and they will remove the sandbox environment provided you have a valid domain. – Isoprene

yes, i said as long as you're out of the SES sandbox, you still need to use the correct AWS region. – Default

Thanks! This worked for me. For some reason the server name changed when I moved out of sandbox without me noticing. – Crum

@Default Suppose my EC2 is in singapore. Then I can't use the SES because I am not in the Virginia or Ireland? – Scientific

@Sarit no, you can still use SES, you just need to use the Asia Pacific region. Or you did anyway when I posted my answer! – Default

@Default Unfortunately. No Asia Pacific region. Then my EC2 can't use it. – Scientific

Is this required even if we get out of the sandbox mode? – Overpraise

Answer 4

@Matt Houser has already answered the questions but I am adding a screenshot from June, 2020 that explains what he said.

Meares

helpful. I see in sandbox both sender and receiver are required to be verified. – Hike

Answer 5

Make sure

1. You add your email to ses and get verified.
2. You enable the Production mode for your account.

Singspiel

Answer 6

I had verified an email address, and then a few days later my domain. When the domain was fully verified (inc DKIM) I was still getting the 'Email address is not verified' error when trying to send emails to email addresses within my domain, that weren't my specific verified address.

I deleted my verified email address, and re-verified it, and it worked immediately. I could then send domain wide emails, whereas before - I could only send to and from the email I had previously verified.

Photophore

I have a grandfathered (pre DKIM) approved domain and email address. I'm setting up a new domain and email address. All the code and keys and everything else are identical and I'm getting this error. I feel like this post comes closest to likely being the issue. I'm going to check after every 6 hours or so, and if it doesn't work, i will delete and re-provision the email. If it instantly works, I will upvote this post as the solution. More to come. – Davisson

Answer 7

Be aware the Verified Identities are actually case sensitive. I was wondering why I got such error, even though my email was verified and out of SandBox.

Script

Answer 8

In my case, I wanted to email to the same verify email address. So, I verified my email by DKIM as @Greg Wozniak mentioned. I saw the field tick green and verified:

But I was still seeing:

Email address is not verified. The following identities failed the check in region...

The solution in my case was to add this function in the code:

def verify_email_identity():
    ses_client = boto3.client("ses", region_name="us-east-1")
    response = ses_client.verify_email_identity(
        # Email address that will receive the email 
        # In my case the same email address 
        # that was verified on Amazon SES
        EmailAddress="[email protected]"
    )
    print(response)

Taken from this website

So, I received a new email to verify the recipient email address. After verify the recipient email address by clicking on the link sent by Amazon SES. I was able to send the email with this code:

client = boto3.client('ses',region_name="us-east-1")
# Try to send the email.
try:
    #Provide the contents of the email.
    response = client.send_email(
        Destination={
            'ToAddresses': [
                [email protected],
            ],
        },
        Message={
            'Body': {
                'Html': {
                    'Charset': "UTF-8",
                    'Data': "Test",
                },
            },
            'Subject': {
                'Charset': "UTF-8",
                'Data': "Test",
            },
        },
        [email protected],
    )
# Display an error if something goes wrong. 
except ClientError as e:
    print(e.response['Error']['Message'])
else:
    print("Email sent! Message ID:"),
    print(response['MessageId'])

Succuss

this is like a couple-levels-deep-into-hell type of debugging – Sandor

Sorry @Sandor I didn't get the meaning of couple-levels-deep-into-hell, is it the answer wrong? – Succuss

No, just impressed by how thorough your answer is. Somewhat disappointed at how bad AWS SES is at surfacing these problems. I'm dealing with something similar rn. – Sandor

This was very helpful! Thank you so much! SES error messages and docs leave a lot to be desired. – Barograph

Answer 9

Make sure

-You have submitted your case request to support customer and explain in what purposes confirm it for to 24 maybe they will ask you about some additional information about your application

Valerlan

Answer 10

I had this issue. I verified domain and email, even the DKIM settings was verified. But still getting this message :

Email address is not verified. The following identities failed the check in region {aws_region}: {email}

I added SourceArn as parameter for sendEmail than get this message :

User `arn:aws:iam::{account_id}:user/{username}' is not authorized to perform `ses:SendEmail' on resource `arn:aws:ses:{aws_region:{account_id}:identity/{email}'

After 2 days I found out the I was using wrong IAM user !

Macmacabre

Thanks! Sometimes we forget the simple steps. I recommend check if the IAM user credential has the right credentials. – Springs

Answer 11

For me the issue was that I was mismatching cases. The verified email and the email sent have to match exactly.

[email protected] vs [email protected]

Photo

Answer 12

I was having the same issue a couple minutes ago, although this time I'm working with the SDK in PHP.

I had to double check the SesClient instantiation code.

$SesClient = new SesClient([
    'profile' => 'default',
    'version' => '2010-12-01',
    'region'  => 'us-west-2',

]);

I discovered that the region in the instantiation code is us-west-2. I went back to my console and discovered that SES account was sandboxed in us-east-2 (Ohio).

I implemented the change in the instantiation code like so

$SesClient = new SesClient([
    'profile' => 'default',
    'version' => '2010-12-01',
    'region'  => 'us-east-2',

]);

It's working now.

Cashmere

Answer 13

Problem

Confusion comes from the fact that your e-mail address shows as "Verified" in AWS SES -> Verified identities and still not working.

In fact, there are two verification:

1. DKIM one (which makes the field tick green and verified)
2. E-mail address verification

That means you must use the e-mail address which you have access to (mailbox) in order to click in the verification link.

Without clicking the link in the e-mail, your identity may be verified but you'll still see the error everywhere.

Simple solution using AWS WorkMail

I am using AWS WorkMail but I've created a new Group instead of another WorkMail account, then added my personal account to it, received a verification e-mail and managed to get: "noreply@..." working.

Christiachristian

Answer 14

Since you are in Sandbox mode, you can add and verify email: "[email protected]" for temporary workout. Otherwise you need to move from production account to sandbox account.

Hog

Answer 15

I had the same problem; after reading this document, I realized some parameters were missing.

If you are using boto3 you should send ReturnPathArn and SourceArn too in send_email, that worked for me.

Wheelsman

Answer 16

Note that when in sandbox at least it seems SES will throw this error if you set the recipient and the sender to the same address (even if verified).

Halfdan

Answer 17

I know there's a lot of comments here; just adding my 2 cents to document the ever evolving AWS console. There's a wizard now in the top left 'get set up' (new). If you're like me, you probably instinctively avoid wizards & get straight into the nuts and bolts. Looks like visually, its the only way to verify external email addresses at the moment

Clicking the button in the left hand side of the get started screen to verify a new identity allowed me to add a gmail address to my custom domain (screen shot is after I verified it).

Haydenhaydn

Answer 18

I had this issue and none of the above worked for me. My issue related specifically to sending via python using boro3. I eventually figured out that the system I was working on had a different set of aws credentials stored in the windows system than it did on the Linux subsystem on the same windows machine. The solution was to set both sets of aws credentials to match the appropriate aws account. I add this here just in case anyone has the same issue and, like me, couldn't find an answer.

Achromatize

Answer 19

In my case, I was using cdk. My email used a custom domain, and the domain said it was verified. When configuring my email with SES through the cdk, I hadn't added the attribute sesVerifiedDomain. Setting that value to the custom domain I was using solved my problem.

Tails

Answer 20

My error is like Net::SMTPFatalError (554 Message rejected: Email address is not verified. The following identities failed the check in region US-EAST-1:, in Rails 6.

I think it is because my SES account is in the sandbox. I need to click Get set up to Request production access.

I am waiting for Amazon to allow me in production (it takes up to 24 hours).

Perrin