Moving to Production Access

What is the SES Sandbox?

When you first set up AWS SES, your account is placed in sandbox mode. This is a safety measure to prevent abuse. You'll see this warning banner in your SES console:

While in the sandbox, you have these restrictions:

Once you have production access, you can send to any recipient (your "From" address must still be verified).

Before You Request

There is a 16-point pre-request checklist that covers the technical setup, the account profile and the request itself. It ticks off as you go and remembers where you got to.

Option 1: AWS Console

1. Open the Amazon SES console
2. Navigate to Account dashboard
3. Click "Request production access" in the sandbox warning banner
4. Fill out the form:
   • Email type: Transactional or Marketing (choose what applies to most of your emails)
   • Website URL: Your application's URL
   • Contact emails: Up to 4 email addresses for account communications
5. Check the acknowledgement box and submit

Option 2: AWS CLI

You can also request production access using the AWS CLI:

aws sesv2 put-account-details \  --production-access-enabled \  --mail-type TRANSACTIONAL \  --website-url https://yourapp.com \  --additional-contact-email-addresses you@yourapp.com \  --contact-language EN

Replace TRANSACTIONAL with MARKETING if you primarily send marketing emails.

What to Expect

Once approved, the sandbox warning will disappear from your dashboard:

Tips for Faster Approval

• Verify your domain first — This is the biggest factor in approval speed
• Use a real website URL — Helps AWS understand your use case
• Provide accurate contact info — In case AWS needs to reach you
• Acknowledge the terms — Confirm you'll only send to opted-in recipients and handle bounces/complaints properly

If Your Request Is Denied

A denial is not final. AWS delivers the decision through a Support Center case tied to your request, and that case is where you reply with more detail. You can also submit a fresh request from the SES console once the review has closed.

Check the review status

The SES account details carry the latest review status and the support case ID:

aws sesv2 get-account \  --query '{Production: ProductionAccessEnabled, Review: Details.ReviewDetails}'

Why requests get denied

The request form only asks for an email type, a website, and contact addresses, so AWS has to infer your sending practices from very little. Denied requests usually share one of these gaps:

• No verified domain — A request from an account that has only verified a single email address gives AWS nothing to check.
• The website does not explain the mail — A parked domain, a landing page with no signup form, or a URL that does not match the sending domain.
• No opt-in story — Nothing in the request says how recipients ended up on the list.
• No bounce or complaint handling — The acknowledgement box says you have a process. AWS wants to know what it is.
• Brand-new AWS account — Reviewers have less history to go on, so expect more questions before approval

What to put in the reply

Answer the questions the form never asked. Reply on the support case with a short, specific description like this one, then adjust it to match what you actually send:

We send a weekly newsletter to customers of <product> (<website URL>).How recipients opt in: every address on the list signed up through the format <signup URL> and confirmed by clicking a link in a confirmation email.We do not buy, rent, or scrape lists.Volume: about <N> emails per week to <N> subscribers, growing at roughly<N> new signups a month.Bounces and complaints: the SES configuration set publishes bounce andcomplaint events to EventBridge. Hard bounces and complaints are removedfrom the list automatically and added to the account-level suppressionlist.Unsubscribe: every email carries a one-click unsubscribe link in the bodyand List-Unsubscribe headers. Requests are honored immediately.Sending domain: <domain> is verified in SES with DKIM, SPF, and DMARC inplace.

Next Steps