Skip to content

Appeal got deferred

-1

Hello, I requested Amazon SES production access for a B2B timesheet management app and was denied by Trust & Safety after providing additional details. I'm preparing to appeal and want to know if improving website/app trust signals alone is enough, or if there's more I should do first. Use case: Transactional emails only (no marketing, newsletters, or bulk campaigns) User invitations, password resets, account verification Timesheet submission/approval/rejection notifications Invoice and system alerts Expected volume: ~50–150 emails/day Region: eu-north-1 (may try eu-west-1 if recommended) What I submitted: Mail type: TRANSACTIONAL A company domain URL in the SES request form Explanation of recipient source, bounce/complaint handling, and that we don't use purchased/scraped lists Why I think it was denied (my guess): Website may not clearly show the product/use case User invitation emails may have looked risky Opt-in explanation may have been unclear (invitations sent before account creation) Bounce/complaint handling was too high-level (no SNS/EventBridge/CloudWatch specifics) Domain authentication may be incomplete (SPF/DKIM mentioned, DMARC unclear) New account/domain with limited history Possibly region-specific (eu-north-1) What I'm planning before the appeal: Add Privacy Policy and Terms of Service links on the application login page Make the website clearer about the B2B timesheet product Include the actual app login URL in the appeal, not just the main domain Add specifics on bounce/complaint handling (SNS, suppression list, CloudWatch alarms) Confirm SPF, DKIM, and DMARC Include sandbox metrics (emails sent, bounce rate, complaint rate) Provide sample email templates Explain invitation controls (only org admins, known employees, no bulk/prospecting) My question: Is updating Privacy Policy / Terms on the login page enough as a trust signal, or should I do more before appealing? For those who got SES approved after a denial, what actually made the difference — website changes, technical details in the appeal, sandbox metrics, switching regions, or something else? Any advice on what Trust & Safety usually wants to see would be really helpful. Thanks!

2 Answers
1

Hello.

Best practices for requesting production access for SES are outlined in the following document.
How about proceeding with the application using this as a reference?
https://repost.aws/ja/articles/ARiPfzfFD3RbGzRPjn-2YdEg/client-vetting-best-practices-for-amazon-ses-customers-managing-multiple-client-accounts

EXPERT

answered a month ago

EXPERT

reviewed a month ago

0

Based on your situation, improving trust signals on your website is important, but it's only one part of what you should focus on before appealing. Here's what typically matters most:

What to prioritize:

  1. Technical implementation details - Be very specific about your bounce and complaint handling mechanisms. Don't just mention that you'll handle them; explain exactly how you'll use SNS topics for bounce and complaint notifications, how you'll automatically add addresses to your suppression list, and what CloudWatch alarms you'll configure to monitor your sending metrics.

  2. Clear use case documentation - Your transactional email use case is strong, but make it crystal clear that these are system-generated notifications triggered by specific user actions within your application. Emphasize that user invitations are sent only by authorized administrators to known employees within their organization, not as prospecting or marketing.

  3. Domain authentication - Ensure SPF, DKIM, and DMARC are fully configured and verified. This is a fundamental trust signal that demonstrates you're serious about email authentication and deliverability.

  4. Sandbox metrics - If you have any sending history in the sandbox, include those metrics. Even a small amount of clean sending history (low bounce rates, zero complaints) can help demonstrate responsible sending practices.

  5. Sample templates - Providing actual email templates helps reviewers understand exactly what you're sending and verify it matches your stated transactional use case.

Regarding your website:

Yes, adding Privacy Policy and Terms of Service is helpful, but also ensure your website clearly explains:

  • What your product does (B2B timesheet management)
  • How email fits into your service (notifications, invitations, alerts)
  • That you're a legitimate business with a real product

About regions:

The region itself (eu-north-1 vs eu-west-1) typically isn't the deciding factor. Focus on strengthening your application rather than switching regions.

What usually makes the difference:

Appeals that succeed typically demonstrate:

  • A legitimate business need with a clear, compliant use case
  • Technical competence in handling email properly
  • Understanding of email best practices and AWS policies
  • Concrete evidence of responsible sending practices

Your planned improvements are on the right track. The key is being thorough and specific in your appeal, showing that you understand email deliverability best practices and have the technical infrastructure to maintain good sending reputation. Make sure every claim you make is backed up with specific implementation details.

When you submit your appeal through the AWS Support Center, be comprehensive but concise, and focus on demonstrating that you're a responsible sender with a legitimate transactional use case.

answered a month ago

EXPERT

reviewed a month ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.