# Production Access Guide Source: https://wraps.dev/docs/guides/production-access # Moving to Production Access Learn how to move out of the AWS SES sandbox and start sending emails to any recipient. 2 min read ## What is the SES Sandbox? When you first set up AWS SES, your account is placed in **sandbox mode**. This is a safety measure to prevent abuse. You'll see this warning banner in your SES console: ![SES sandbox warning banner in AWS console](https://wraps.dev/docs/ses-sandbox-banner.png) While in the sandbox, you have these restrictions: - **Verified recipients only** — You can only send to email addresses you've manually verified - **200 emails per day** — Maximum of 200 messages in a 24-hour period - **1 email per second** — Sending rate is limited to 1 message per second Once you have production access, you can send to any recipient (your "From" address must still be verified). ## Before You Request Verify your domain first for faster approval AWS recommends verifying your sending domain before requesting production access. This significantly speeds up the approval process. See our [Domain Verification guide](https://wraps.dev/docs/guides/domain-verification) for instructions. There is a [16-point pre-request checklist](https://wraps.dev/blog/ses-sandbox-guide#pre-request-checklist) that covers the technical setup, the account profile and the request itself. It ticks off as you go and remembers where you got to. ## Option 1: AWS Console 1. Open the [Amazon SES console](https://console.aws.amazon.com/ses/) 2. Navigate to **Account dashboard** 3. Click **"Request production access"** in the sandbox warning banner 4. Fill out the form: - **Email type:** Transactional or Marketing (choose what applies to most of your emails) - **Website URL:** Your application's URL - **Contact emails:** Up to 4 email addresses for account communications 5. Check the acknowledgement box and submit ## Option 2: AWS CLI You can also request production access using the AWS CLI: terminal.sh ``` aws sesv2 put-account-details \ --production-access-enabled \ --mail-type TRANSACTIONAL \ --website-url https://yourapp.com \ --additional-contact-email-addresses you@yourapp.com \ --contact-language EN ``` Replace `TRANSACTIONAL` with `MARKETING` if you primarily send marketing emails. ## What to Expect ### Review Timeline AWS typically responds within **24 hours**. If they need additional information, the review may take longer. You cannot edit your request while it's under review. Once approved, the sandbox warning will disappear from your dashboard: ![SES dashboard after production access is approved](https://wraps.dev/docs/ses-production-approved.png) ## Tips for Faster Approval - **Verify your domain first** — This is the biggest factor in approval speed - **Use a real website URL** — Helps AWS understand your use case - **Provide accurate contact info** — In case AWS needs to reach you - **Acknowledge the terms** — Confirm you'll only send to opted-in recipients and handle bounces/complaints properly ## If Your Request Is Denied A denial is not final. AWS delivers the decision through a Support Center case tied to your request, and that case is where you reply with more detail. You can also submit a fresh request from the SES console once the review has closed. ### Check the review status The SES account details carry the latest review status and the support case ID: terminal.sh ``` aws sesv2 get-account \ --query '{Production: ProductionAccessEnabled, Review: Details.ReviewDetails}' ``` | Status | Meaning | | --- | --- | | PENDING | AWS is still reviewing the request. | | GRANTED | Production access is on. The sandbox banner disappears. | | DENIED | AWS declined. Open the case ID in Support Center and read the reason they gave. | | FAILED | An internal error on the AWS side and the request never reached review. Submit it again. | ### Why requests get denied The request form only asks for an email type, a website, and contact addresses, so AWS has to infer your sending practices from very little. Denied requests usually share one of these gaps: - **No verified domain** — A request from an account that has only verified a single email address gives AWS nothing to check. - **The website does not explain the mail** — A parked domain, a landing page with no signup form, or a URL that does not match the sending domain. - **No opt-in story** — Nothing in the request says how recipients ended up on the list. - **No bounce or complaint handling** — The acknowledgement box says you have a process. AWS wants to know what it is. - **Brand-new AWS account** — Reviewers have less history to go on, so expect more questions before approval Paste the denial into the request builder The [SES production access request builder](https://wraps.dev/tools/ses-production-access) matches a denial against these same gaps and drafts the reply for the support case. It runs in your browser — the text you paste is not uploaded anywhere. ### What to put in the reply Answer the questions the form never asked. Reply on the support case with a short, specific description like this one, then adjust it to match what you actually send: case-reply.txt ``` We send a weekly newsletter to customers of ().How recipients opt in: every address on the list signed up through the format and confirmed by clicking a link in a confirmation email.We do not buy, rent, or scrape lists.Volume: about emails per week to subscribers, growing at roughly new signups a month.Bounces and complaints: the SES configuration set publishes bounce andcomplaint events to EventBridge. Hard bounces and complaints are removedfrom the list automatically and added to the account-level suppressionlist.Unsubscribe: every email carries a one-click unsubscribe link in the bodyand List-Unsubscribe headers. Requests are honored immediately.Sending domain: is verified in SES with DKIM, SPF, and DMARC inplace. ``` Fix the gap before you reply, not after If the domain is not verified, verify it first. If the site has no signup form or privacy page, add one. A reply that describes a process AWS cannot see on your site or in your account does not help your case. Wraps sets up the bounce and complaint pipeline and the suppression list during `wraps email init`, so you can describe it accurately. ## Next Steps Verify Your Domain Set up DKIM, SPF, and DMARC for better deliverability. [Domain Verification](https://wraps.dev/docs/guides/domain-verification) Send Your First Email Once approved, start sending with the Wraps SDK. [Email Quickstart](https://wraps.dev/docs/quickstart/email)