Identity and verification
The request reached SES and SES refused it over what is, or is not, verified.
| AWS exception | What AWS says | Wraps code |
|---|---|---|
| MessageRejectedSMTP 554 | Email address is not verified. The following identities failed the check in region US-EAST-1: sender@example.com | SES_MESSAGE_REJECTED |
| ConfigurationSetDoesNotExistException | Configuration set <ConfigurationSetName> does not exist. | SES_CONFIG_SET_MISSING |
| MailFromDomainNotVerifiedException | Amazon SES could not read the MX record required to use the specified MAIL FROM domain. | SES_MAIL_FROM_NOT_VERIFIED |
Throughput and quota
The send was well formed and you asked for more than the account is allowed right now.
| AWS exception | What AWS says | Wraps code |
|---|---|---|
| ThrottlingSMTP 454 | Throttling: Maximum sending rate exceeded | AWS_THROTTLED |
| LimitExceededExceptionSMTP 454 | Daily message quota exceeded | AWS_LIMIT_EXCEEDED |
Account and configuration set state
Sending is switched off, either for the whole account or for one configuration set.
| AWS exception | What AWS says | Wraps code |
|---|---|---|
| AccountSendingPausedException | Email sending is disabled for your entire Amazon SES account. | SES_ACCOUNT_SENDING_PAUSED |
| ConfigurationSetSendingPausedException | Email sending is disabled for the configuration set <ConfigurationSetName>. | SES_CONFIG_SET_SENDING_PAUSED |
Credentials and permissions
The request never got past authentication or authorization, so SES never saw the message.
| AWS exception | What AWS says | Wraps code |
|---|---|---|
| InvalidClientTokenId | The security token included in the request is invalid. | ACCESS_KEY_INVALID |
| SignatureDoesNotMatch | The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. | ACCESS_KEY_INVALID |
| UnrecognizedClientException | The security token included in the request is invalid. | ACCESS_KEY_INVALID |
| ExpiredTokenException | The security token included in the request is expired. | SESSION_TOKEN_EXPIRED |
| AccessDeniedException | User: arn:aws:iam::123456789012:user/dev is not authorized to perform: ses:SendEmail on resource: arn:aws:ses:us-east-1:123456789012:identity/example.com | IAM_PERMISSION_DENIED |
Not the error you have
These are the AWS exceptions the Wraps CLI maps to specific guidance. Anything else it surfaces as the real AWS error code rather than guessing, because the failure mode worth avoiding is a tool that reports every unknown AWS error as a credentials problem. The Wraps-side codes are documented separately in the CLI error reference.
For the operational side of SES rather than a specific exception, start at running Amazon SES in production.