SNS emails stopped reaching Exchange distribution mailboxes in N. Virginia

Amazon SNS does not support delivery status logging for email endpoints. To track email delivery and troubleshoot issues with email notifications, you should use Amazon Simple Email Service (Amazon SES) instead, as it provides comprehensive monitoring and tracking capabilities for email sending activity.

For your situation with emails not reaching Exchange distribution mailboxes, here are some steps to investigate:

First, check the AWS Service Health Dashboard to see if there are any known issues with Amazon SNS or related services in the us-east-1 region.

Since SNS doesn't provide detailed email delivery tracking, consider the following possibilities:

1. Contact the recipients or their email administrators to verify that the emails aren't being filtered as spam or blocked by Exchange's mail filtering rules. Distribution lists can have specific filtering policies that may have recently changed.

2. The issue could be related to greylisting - a spam prevention technique where mail servers temporarily reject messages from unknown senders. This can cause delivery delays, and the messages may eventually be delivered on retry attempts.

3. Verify that the sender email addresses and any Return-Path addresses are valid and properly configured.

4. Check whether the emails are arriving at individual mailboxes but specifically failing for distribution lists, which could indicate an Exchange-specific configuration issue rather than an AWS issue.

If you have a paid AWS Support Plan, you can open a technical support case through the AWS Support Center (https://console.aws.amazon.com/support/) to investigate further. When opening a case, provide relevant recipient addresses and any request or message IDs from your SNS publish operations.

For better email delivery monitoring and troubleshooting capabilities in the future, consider migrating your email notifications to Amazon SES, which provides detailed delivery status tracking through Amazon CloudWatch Logs.
Sources
Amazon SES Delivery problems - Amazon Simple Email Service
Amazon SES Delivery problems - Amazon Simple Email Service
Activate delivery status logging for Amazon SNS | AWS re:Post

Hey Thiago, I've been looking at this same pattern and the cross-customer, us-east-1 scoping is the tell here. When drops are silent and affect multiple environments in the same region simultaneously, it almost always comes down to either a Microsoft 365 inbound filter reacting to an SNS sending-IP range change, or a regional blocklist update on the Exchange side, not a per-customer misconfiguration.

The fastest way to confirm which it is: enable SNS delivery status logging to CloudWatch Logs. That will show you whether SNS is recording a successful handoff or a bounce/rejection, and if there's a rejection code, it'll usually point directly at the Exchange/M365 layer. From there you can decide whether SES with event publishing gives you the delivery tracking SNS lacks for email.

One thing I'd be curious about: are the affected subscription endpoints all going to Exchange distribution lists specifically, or are individual Exchange mailboxes also failing? That distinction changes the diagnosis pretty quickly.

I'll dig into the SNS delivery logging setup for Exchange scenarios and post back here with the specific CloudWatch config steps if that would help.