How do I resolve Amazon SES 554 or 400 "Message rejected" errors?

Short description

When you use Amazon SES to send emails, you must verify the domains and email addresses that you send emails from. If you use an unverified identity to send emails, then you can get Message rejected errors. These errors can apply to the From, Source, Sender, or Return-Path addresses.

If you use the Amazon SES Simple Mail Transfer Protocol (SMTP) interface, then the error is similar to the following: "554 Message rejected: Email address is not verified. The following identities failed the check in region region: identity0, identity1, identity2."

If you sent the email from an AWS Identity and Access Management (IAM) user in Amazon SES, then the error is 554 Access denied.

If you use the Amazon SES API interface, then the error is 400 Message rejected.

Resolution

To resolve 554 or 400 Message rejected errors with the message Email address is not verified, take the following actions:

• On the Amazon SES console, confirm that the identity that you send emails from has a verification status of verified and not pending or failure. If your identity is stuck in the pending state, then see What can I do if my domain is stuck in the "verification pending" status or in the "unverified" verification status in Amazon SES?

• If your email address is verified, then verify that the email address on the failed message is correct. Email addresses are case-sensitive. The email address that you use to send the message must match your verified email address.

• Check whether your account is in the Amazon SES sandbox for the AWS Region that you use to send emails. If your account is in the Amazon SES sandbox, then you must verify the recipient email address and your sender identity. Or, you can request to move your SES account out of the Amazon SES sandbox.

  Note: If you attached a sending authorization policy to your identity, then you must move the delegate sender account out of the Amazon SES sandbox.

• Confirm that the method that you use to send emails has the correct Region. Email identity verification is separate for each Region. You must verify the identity that you use to send emails in each Region that you want to send emails from.

• Confirm that you're connected to the correct Amazon SES endpoint. You must communicate with the endpoint for the SES SMTP interface or the Amazon SES API in the correct Region.

• If you sent the email from an IAM user in Amazon SES and received the error 554 Access denied, then additional troubleshooting is required. For more information, see How do I resolve a 554 "Access denied" error when I send an email from my IAM user in Amazon SES?

• For a 400 error, check the error stack to determine what caused the error. The Email address is not verified error message occurs because your identity failed the verification check in the specified Region.

For more information, see Amazon SES email sending errors.