AWS has rejected our requests for SES production access even though we completed the required setup steps. We are a local ISP with a website that has been operating for more than 10 years, and we only need SES for transactional messages such as invoices and payment reminders—never marketing or newsletters.
Our ERP manages our customer accounts and would send the emails. Cancelled customers would no longer receive messages, address changes would update the recipient record, and customers who prefer WhatsApp or another delivery method would be removed from email billing notifications.
The support responses have been very general and have not explained what needs to change. Is there a better way to present the request or escalate the case so AWS will review it more seriously?
4 Answers
A long-running website and a legitimate business help establish context, but they are not the main things reviewers need. They are more likely to focus on list provenance, complaint and bounce rates, authentication, and whether a compromised account or stale address could generate unwanted mail. Make those safeguards easy to evaluate and avoid including customer-identifying information in the case.
While you continue pursuing approval, consider using a transactional email provider such as Postmark or Resend as a temporary option. That can keep invoices moving while the SES review is pending, though you should still document your sending and suppression procedures regardless of provider.
Your explanation may be legitimate, but it is probably too general for an email provider assessing sender risk. Describe the controls in concrete, testable terms: how bounces and complaints are detected, how addresses are automatically suppressed, how opt-outs work, and how your ERP prevents cancelled or ineligible accounts from being mailed.
It can also help to include the exact message types, expected daily and peak volumes, confirmation that recipients are existing customers rather than purchased lists, your SPF/DKIM/DMARC setup, and a redacted sample invoice or reminder. Treat the follow-up as a sender-risk and abuse-prevention plan rather than simply an escalation request.
Rewrite the request as a short operational runbook. Explain that the ERP is the only sending system, there are no bulk campaigns or cold emails, and account status controls eligibility. State the expected volume, how address changes are handled, and exactly what happens after a bounce, complaint, or opt-out. Ask support to identify which specific control they believe is missing instead of only asking for escalation.
That makes sense. I was trying to explain how our business works, but I didn't present the process as a set of automated safeguards.