Guide · Amazon SES
How to get out of the Amazon SES sandbox (production access request)
Short answer
To get out of the Amazon SES sandbox, verify your sending domain, then open Account dashboard in the SES console, choose View Get set up page and Request production access. Pick Marketing or Transactional, add your website URL, tick the acknowledgement about opt-in recipients and bounce handling, and submit. AWS Support gives a first response within 96 hours. Sandbox status is per region, so request it in the region you send from.
By BYOMailer · Updated 2026-11-06 · Facts checked against the official docs in November 2026
What the SES sandbox blocks
Every new SES account starts in the sandbox, in every region. All SES features work. The limits are on who you can send to and how much:
- You can only send to verified email addresses and domains, or to the SES mailbox simulator.
- You can send at most 200 messages in a 24-hour period.
- You can send at most 1 message per second.
- With sending authorization, neither you nor the delegate sender can send to addresses that are not verified.
- Bulk actions and API calls for the account-level suppression list are off.
So 200 a day. Fine for testing, useless for a newsletter. Production access removes all of it, and you can send to anyone. You still have to verify every identity you send from.
Step 1Verify your sending domain first
Do this before you ask. In the SES console, go to Configuration → Identities → Create identity, choose Domain, and publish the three DKIM CNAME records it gives you. AWS calls a verified domain a best practice that helps your request get approved faster, and once a domain is verified you can request production access right from the Get set up page.
Use the region you will actually send from. The full DNS setup (DKIM, a custom MAIL FROM domain and DMARC) is in our SES DKIM, SPF and DMARC guide.
Step 2Set up bounce and complaint handling before you ask
The form ends with an acknowledgement: you only send to people who asked for your email, and you have a process for bounce and complaint notifications. Tick it only if it is true. SES requires one of three feedback methods to send at all: an Amazon SNS topic, email feedback forwarding, or event publishing.
The SES team's own advice is to test throttling, bounce handling and unsubscribe handling before you request access. The SNS setup and the bounce and complaint thresholds are in our SES bounce and complaint rate guide.
Step 3Open the production access request form
- Open the SES console at
console.aws.amazon.com/sesand pick your region. - In the navigation panel, choose Account dashboard.
- In the warning box "Your Amazon SES account is in the sandbox", choose View Get set up page, then Request production access.
Step 4Fill in the request form
- Mail type: Marketing or Transactional, whichever is the majority of what you send. A newsletter is Marketing.
- Website URL: the site your subscribers sign up on. AWS uses it to understand what you plan to send, so it should show a real product and a real signup form.
- Additional contacts: up to 4 email addresses, comma separated, for messages about your account.
- Preferred contact language: English or Japanese.
- Acknowledgement: you send only to people who explicitly asked, and you handle bounces and complaints.
Prefer the CLI? The same request is one command:
aws sesv2 put-account-details \
--production-access-enabled \
--mail-type MARKETING \
--website-url https://example.com \
--additional-contact-email-addresses [email protected] \
--contact-language ENStep 5Write a use case AWS can approve
This is where most requests win or lose. The current form in the AWS docs has no long text box, but if AWS needs more, it asks on the support case. Have the answer ready. The SES team lists what they want to read:
- What your company does and what you will email people about.
- One or two concrete use cases, with a sample email (remove anything sensitive).
- How you build your list. Opt-in only, never bought.
- How you handle bounces and complaints after SES notifies you.
- How people unsubscribe.
- Your daily and weekly volume, and your peak send rate per second.
- If you were denied before, say so, and say why.
AWS is explicit that "Please remove from sandbox and move to production" is not enough. Specifics get approved. Here is a sample for a newsletter. Replace every bracket with your real numbers, and do not claim anything you do not do.
Company: [Your company], [one line on what the product does]. Website: https://[yourdomain.com]
What we send: a weekly product newsletter (release notes, short how-to tips) and a monthly digest. Mail type: Marketing.
How people join the list: they tick an opt-in box at signup on https://[yourdomain.com]/register or use the newsletter form on our blog. New subscribers get a confirmation email and are only added after they click it (double opt-in). We do not buy, rent or share lists.
Bounces and complaints: SES sends bounce and complaint events to an SNS topic. We remove hard bounces and complaints from the list automatically, and stop mailing an address after repeated soft bounces. We watch the reputation metrics page and have CloudWatch alarms at 5% bounces and 0.1% complaints.
Unsubscribe: every email has a visible unsubscribe link and List-Unsubscribe / List-Unsubscribe-Post headers for one-click unsubscribe. Unsubscribes take effect right away.
Volume: about [N] subscribers today. About [N] emails per week, [N] on the busiest day, sent at [N] emails per second or less.
Authentication: the sending domain is verified in [region] with Easy DKIM, a custom MAIL FROM domain and a DMARC record.
Sample email (subject): "[Product] update: [feature] is live"Step 6Submit, then answer the support case
After you submit, a banner confirms the request is under review. You cannot edit your account details until the review ends. AWS Support gives an initial response within 96 hours. If they ask a question, answer on the same case, with the same level of detail as above.
Once you are in production, SES gives you a daily sending quota and a maximum send rate. You can see both on the Account dashboard, and you can ask for more any time with a new case in the AWS Support Center.
Why SES production access requests get denied
AWS does not publish a list of denial reasons, and it says it reviews every request carefully to keep unsolicited email off its systems. What it does publish is what a request has to show. Requests that miss these are the weak ones:
- A one-line request with no use case, no volume and no sample email.
- No clear opt-in. A list you bought or scraped is the opposite of what AWS asks for.
- No process for bounces and complaints, even though the form makes you confirm one.
- No way to unsubscribe.
- A website that does not match the email you describe, or has no signup form at all.
What to do after a denial
- Read the reply on the support case. Note every question it asks.
- Fix the real gap first. Verify the domain, set up SNS feedback, add the unsubscribe link, put a signup form on the site.
- Answer on the case with the full use case from step 5. Say that an earlier request was denied and what you changed since. AWS asks for exactly this.
- Keep testing in the sandbox while you wait. Send to verified addresses and to the mailbox simulator, so you can show that bounces and complaints are processed.
How BYOMailer handles this step for you
Honest part first: BYOMailer cannot request production access for you. AWS approves your account, not ours, because you send through your own SES. What BYOMailer does is make the things AWS asks about true before you ask:
- When you connect SES, BYOMailer creates an SNS topic in your AWS account and routes bounce, complaint and delivery events through it, so your feedback process exists on day one.
- Hard bounces and complaints suppress the contact automatically. So do 3 soft bounces in a row.
- Campaign emails carry one-click
List-Unsubscribeheaders, and your templates get anunsubscribe_urlvariable for the visible link. - Lists can require a confirmation email before a contact gets anything (double opt-in).
- Your settings page shows whether your SES account is in Sandbox or Production.
The short checklist is in our docs: Request production access. To see what SES costs at your volume, try the SES savings calculator, or read why people run email marketing on Amazon SES.
Frequently asked questions
How long does Amazon SES production access take?
The AWS docs say AWS Support gives an initial response within 96 hours. If AWS needs more information from you, it can take longer. You cannot edit your account details while the review is open.
Is the SES sandbox per region?
Yes. Sandbox status is separate for each AWS Region. If you got production access in us-east-1, your account in eu-west-1 is still in the sandbox until you request access there too.
Can I test SES while I wait in the sandbox?
Yes. In the sandbox you can use every SES feature. You can only send to verified addresses and domains or to the SES mailbox simulator, with a cap of 200 messages per 24 hours and 1 message per second.
Should I choose Marketing or Transactional?
Pick the type that describes the majority of the mail you will send. A newsletter or a product update list is Marketing. Password resets and receipts are Transactional.
Do I still need to verify identities after I leave the sandbox?
Yes. In production you can send to any recipient, but every From, Source, Sender or Return-Path address must still use a verified identity.
Why did AWS deny my SES production access request?
AWS does not publish a list of denial reasons. Its own guidance asks for specifics: what you send, how people join your list, how you process bounces, complaints and unsubscribes, and your volume. A request that only says "please remove us from the sandbox" is the kind AWS calls too vague.
Keep exploring