# How to Get Out of AWS SES Sandbox Source: https://wraps.dev/blog/ses-sandbox-guide ## Why Most Requests Get Denied Amazon SES sandbox restrictions exist to protect their email infrastructure's reputation. Getting out requires proving you understand email deliverability — not just that you have a legitimate business. 2024 Change While AWS documentation calls email authentication "strongly recommended," community reports indicate that requests without SPF, DKIM, and DMARC configured are frequently denied. Set up your DNS records before submitting. ## Pre-Request Readiness Checklist Complete every required item before submitting. Your progress is saved automatically. Each checkbox you complete increases your approval likelihood. Pre-Request Checklist 0 of 16 complete Technical Setup0/6 Verify your domain in SES Not formally required, but AWS says verifying a domain first helps the request get approved faster — and a single verified address gives a reviewer nothing to check Recommended Enable Easy DKIM Add all 3 CNAME records and wait for "Verified" status Required Publish SPF record v=spf1 include:amazonses.com ~all on your MAIL FROM subdomain Required Publish DMARC policy Start with p=none for monitoring, can strengthen later Recommended Configure SNS for bounces Create SNS topic and subscribe your endpoint Recommended Configure SNS for complaints Create separate SNS topic for complaint notifications Recommended Account & Profile0/4 Use business email on AWS account Avoid Gmail, Hotmail, etc. Use your domain email Live website on your domain Not a parked page or "coming soon" — real content showing your business Recommended Privacy policy published Accessible privacy policy on your website Contact information visible Email or contact form on your website Request Preparation0/6 Know what the form actually asks Marketing or transactional, a website URL, up to 4 contact addresses, a language and an acknowledgement — there is no free-text use-case box. Save the detail for the support case if AWS comes back asking Required Explain consent/opt-in mechanism How do recipients sign up? Where do they consent? Recommended Document bounce handling process What happens when an email bounces? Auto-suppression? Recommended Document complaint handling process How do you handle spam complaints? Immediate removal? Recommended Provide realistic volume estimates Current volume and 6-month projection with justification Explain unsubscribe mechanism One-click unsubscribe for marketing, suppression list for all ## Are You Ready to Submit? Walk through this decision tree to confirm you've completed the critical steps. If you hit a "Stop" node, complete that step first. Decision Is your domain verified with Easy DKIM enabled? YES Check custom MAIL FROM Verify SPF record is published NO Stop — Complete DNS setup first Requests without DKIM are almost always denied Decision Is SNS configured for bounces AND complaints? YES Answer what the form leaves out There is no free-text box — the detail goes on the support case if AWS asks NO Configure SNS topics Required for bounce/complaint handling proof Ready Submit production access request Expect initial response within 24 hours ## DNS Configuration Your DNS records are the foundation of email authentication. Here's exactly what you need. SPF Record for Custom MAIL FROM Add this TXT record to your MAIL FROM subdomain (e.g., mail.yourdomain.com): TXT Record Copy v=spf1 include:amazonses.com ~all DMARC Policy Record DKIM CNAME Records **Verify your setup:** Use our [free domain analyzer](https://wraps.dev/tools) to check if your SPF, DKIM, and DMARC records are correctly configured before submitting your production request. ## Request Template Builder Fill in your details to generate a comprehensive production access request. The template includes all the sections AWS reviewers look for. Request Template Builder Fill in your details to generate a production-ready request Company / Product Name Website URL Primary Use CaseTransactional (account alerts, receipts, etc.)Marketing (newsletters, promotions) Specific Email Types Current Daily Volume Projected Daily Volume (6 months) Consent / Opt-in Mechanism Generated Request Text Copy to Clipboard We operate \[Company Name\] at \[website URL\], a software platform requiring Amazon SES for transactional email communications. EMAIL USE CASE AND TYPES \[Describe the specific types of emails you send, e.g.: - Account verification emails when users sign up - Password reset emails triggered by user requests - Order confirmations after purchases - Shipping notifications when orders are dispatched\] These emails are not marketing communications—they are triggered by specific user actions and are essential to our service operation. TECHNICAL IMPLEMENTATION Our domain is fully verified with Easy DKIM enabled (all 3 CNAME records verified). We have configured a custom MAIL FROM domain with proper SPF alignment. Our DMARC policy is published and actively monitored. We have configured Amazon SNS topics for both bounce and complaint notifications: - Bounce notifications trigger automatic removal of the failed address from our active sending list - Complaint notifications result in immediate suppression of the complainant's address CONSENT AND OPT-IN MECHANISM \[Explain how users consent to receive emails: - Users provide their email during account registration - Checkbox confirming acceptance of Terms of Service and Privacy Policy - Double opt-in confirmation for marketing communications\] VOLUME ESTIMATES Current sending volume: \[X\] emails per day Projected volume (6 months): \[Y\] emails per day Our sending pattern is gradual and event-driven, not bulk blasts. Volume increases correlate with organic user growth. BOUNCE AND COMPLAINT HANDLING Bounce handling: Our system receives SNS notifications for bounced emails. Hard bounces are immediately and permanently suppressed—these addresses are never retried. Soft bounces are retried up to 3 times with exponential backoff before being suppressed. Complaint handling: Any complaint results in immediate removal from all future communications. We manually review each complaint to identify potential issues with our email content or targeting. UNSUBSCRIBE PROCESS As these are transactional emails essential to service operation, users manage their notification preferences through their account settings. Users can disable non-essential notifications while still receiving critical account and security emails. We are committed to maintaining excellent deliverability and sender reputation. We understand that our use of SES reflects on all SES customers, and we take this responsibility seriously. Click to copy 350 words — Try to reach ~400+ words Pro Tip Copy the generated text and paste it into the "Use case description" field in the SES console. Don't be afraid to make it longer — detailed requests dramatically outperform brief ones. One command ### Or skip the wait entirely Wraps deploys production-ready SES (DKIM, SPF, DMARC, bounce handling, SNS, suppression) to your AWS account in minutes. Still your AWS, still $0.10/1K — just no boilerplate. [Deploy in one command](https://wraps.dev/docs/quickstart/email)[See your cost](https://wraps.dev/tools/ses-calculator) ## After You Submit Here's what to expect once you hit submit. #### 0-24 Hours: Initial Review AWS Trust & Safety reviews your request. Most responses come within 24 hours during business days. #### Response: Approved or Follow-up You'll either get production access or receive questions/denial. Follow-up questions are actually a good sign — they're engaging with your request. #### If Approved: Gradual Increase Start with your approved quota. AWS automatically increases limits as you demonstrate good sending practices. ## Denied? Here's What to Do First-time denial is so common it's almost expected. Here's how to recover. The Standard Denial AWS sends a vague response: "We reviewed your request and determined that your use of Amazon SES could have a negative impact on our service." This tells you nothing — don't take it personally. Status Request Denied Don't panic — first-time denial is extremely common Decision Is this your first denial? YES — First denial Reply on the case AWS opened Fix the gap first, then reply on the existing case with your tech setup, consent flow and handling. Do not open a fresh request. Multiple denials Request escalation Reply on the same case and list only changes you have already made — AWS says outright not to include steps you plan to take. Action Attach supporting evidence - • Previous ESP invoices (SendGrid, Mailgun, etc.) - • Social media presence with engaged following - • Press coverage or customer testimonials - • Screenshots of your email setup Paste the denial into the [SES production access request builder](https://wraps.dev/tools/ses-production-access) and it will tell you which of the four gaps the refusal points at and draft the reply for the support case. It runs in your browser; the denial text is not uploaded anywhere. ## Common Mistakes That Trigger Denial Vague or brief use case description "I want to send transactional emails to my users" is not enough. Explain exactly what triggers each email, how users opt in, and what content they contain. Missing DNS authentication No bounce/complaint handling explanation Website doesn't match the request Using a free email address Requesting marketing access as a new user ## Frequently Asked Questions Do I need a live app before requesting production access? My domain is brand new. Will that cause denial? Can I request access for multiple AWS accounts? How long until my limits automatically increase? Should I use SES or a third-party provider? ## Additional Resources ### Wraps Resources [AWS SES Production Architecture Guide](https://wraps.dev/blog/ses-production-architecture)[Your DMARC Policy is Useless](https://wraps.dev/blog/your-dmarc-policy-is-useless)[Domain Verification Guide](https://wraps.dev/docs/guides/domain-verification) ### AWS Documentation [AWS Official Documentation: Request Production Access](https://docs.aws.amazon.com/ses/latest/dg/request-production-access.html)[AWS Email Authentication Guide (SPF, DKIM, DMARC)](https://docs.aws.amazon.com/ses/latest/dg/send-email-authentication.html) ### Skip the sandbox nightmare entirely Wraps CLI deploys production-ready email infrastructure to your AWS account in one command. DNS records, bounce handling, reputation monitoring — all handled. [Get Started Free](https://wraps.dev/docs/quickstart/email)[Learn About Wraps CLI](https://wraps.dev/cli)