• A sending-domains page lists every SES identity with its verification state and the DKIM CNAMEs and MAIL FROM records still to publish, adds a domain with SES-managed Easy DKIM, and opens a per-identity sheet for the configuration set that governs it: tracking domain, TLS policy, suppression reasons and event destinations — the sheet flags an OPTIONAL tracking HttpsPolicy and an empty event-destination list, the usual reasons click links break and delivery events never arrive. Onboarding had told customers they could manage domains in the dashboard while the only working paths were installing the CLI or rebuilding the CloudFormation stack
• The SES suppression list is browsable from the dashboard, and an address can be removed. A COMPLAINT-reason removal re-reads the reason from SES rather than trusting the browser, and refuses without an explicit acknowledgement. The underlying email.suppression.* grants now ship on every deployment path — CDK, Pulumi and CloudFormation — but an existing deployment needs wraps platform update-role (CLI v3.9.0+), a CDK 0.3.0+/Pulumi 0.4.0+ redeploy, or a CloudFormation stack update before those calls stop returning AccessDenied
• The account page flags when the console role’s policy is behind the version Wraps expects and links to the IAM-console repair route, and reports AWS’s actual SES production-access verdict instead of discarding it. wraps email status --json reports sandbox state and quota and recognizes a CloudFormation deployment instead of exiting 1 with “No email infrastructure found”
• Fix: a broadcast into an SES account AWS has paused is now blocked at the review step instead of running past the point-of-no-return dialog and failing every recipient — a PROBATION account only warns rather than blocking, and a check that cannot read account state never refuses a legitimate send. Fix: the sending-domains list pages through every SES identity instead of showing only the first 100

Platform v0.28.0