AWS Verified Account for Sale How to set up Amazon SES bounce and complaint notifications

AWS Account / 2026-08-07 15:34:28

How to set up Amazon SES bounce and complaint notifications (practical checklist + account/risk notes)

If you’re searching this topic, you usually don’t want a definition of bounces/complaints—you’re trying to: (1) stop “quiet” deliverability damage, (2) route events into your logs/CRM, and (3) avoid account flags when your send patterns look risky. Below is the setup path I’ve used in real SES deployments, including the “gotchas” that show up during verification and after you start sending.

What you’re likely trying to achieve (and what SES actually needs from you)

Before clicking through the console, decide which notification behavior you need. In practice, most teams fall into one of these scenarios:

Scenario A: You just set up SES for a new domain and want bounce/complaint events pushed to an S3 bucket or SNS topic. You also need it working immediately while you finish identity verification.
Scenario B: You’re already sending, but deliverability is inconsistent. You want complaints + bounces separated by reason, with minimal delays.
Scenario C: You’re integrating SES with a third-party ESP/CRM. You need a stable event pipeline and a clear mapping of complaint/bounce types to suppression logic.
Scenario D: Your account is under risk control review or you suspect address-level filtering is causing unwanted “hard bounces.” You need better visibility before you scale volume.

The SES notification you configure is only half the system; the other half is what you do with the events (suppression, feedback loop handling, and operational alerts). If you set notifications but ignore them, the cost is paid later in account reputation and incident response time.

AWS Verified Account for Sale Prerequisites checklist (don’t skip these—most failures happen before/while you enable notifications)

When people fail to “set up bounce and complaint notifications,” the root cause is often one of these operational gaps:

Not verified sending identity: Domain/Email identity in SES not fully verified, or verification is pending.
Wrong region assumption: SES resources (notification, SNS/SQS/S3) must align with the SES region you configured for sending.
Missing permissions: SES is not allowed to publish to your SNS topic or write to your S3 bucket (bucket policy/ACL issues).
Production sending uses a different identity than you configured: Notifications are attached to sending identity behavior you didn’t actually use.
Account-level throttles / suppression: You might be receiving events but also throttling or temporarily restricting sending due to risk signals.

Quick practical “pre-flight” (5 minutes)

In AWS Console, open SES and confirm the region where you’re sending. SES will not deliver events to resources that are in a different region unless you’ve explicitly built cross-region routing (most teams avoid this).
Confirm your Verified identities (Domain/Email). If you’re using a domain, ensure all required DNS records are in place and fully propagated.
Decide your event sink:
- SNS for real-time routing to multiple consumers
- S3 for batch processing and cost-effective storage
- CloudWatch for alarms (you’ll still route to SNS/SQS/S3 for actual payload handling)
Prepare IAM permissions (or use an existing pipeline role) so SES can publish/write.
Plan suppression and alerting logic before scaling send volume—because complaints/hard bounces should trigger immediate changes.

Console steps: enable bounce and complaint notifications (SNS-first approach)

The fastest production path I recommend is SNS → SQS (optional) → your webhook/worker. It’s robust, debuggable, and scales with your sending volume.

Step 1: Create an SNS topic for SES events

Go to SNS → Create topic. Name it something like ses-bounce-complaint-events.
Keep the region consistent with SES. (If your SES account is in us-east-1, create the topic there.)

Step 2: Attach the SES permissions policy to SNS (the common “it doesn’t work” part)

SES must have permission to publish to your SNS topic. In real deployments, this fails due to a missing policy statement or a policy scoped to the wrong account/region.

What to do:

Edit the SNS topic policy (Topic → Access policy). Add an allow statement for SES with your SourceArn and the sending account.
Use exact ARNs and region/account IDs. “Close enough” causes silent failure.

If you’re using multiple SES identities, you still generally attach permissions once per topic, as long as SES can publish.

Step 3: Configure SES notification destinations

In SES Console → Configuration sets. Create a configuration set (or use an existing one).
In that configuration set, go to Event destinations. Add a destination of type SNS pointing to your SNS topic.
Select which event types to receive:
- Bounce (includes hard/soft bounces; you’ll parse the reason)
- Complaint (mailbox complaints / feedback loop)
Save changes.

After saving, you should see SES publish test events only after there’s activity or test hooks. Don’t assume it “works” until you verify ingestion on the SNS subscriber side.

Alternative: S3-based storage (best if you want cheap long-term audit)

If you’re building compliance/audit trails, S3 can be cheaper than pushing everything into a streaming pipeline. The operational risk is that you’ll need downstream processing for real-time suppression.

How to wire S3 correctly

Create an S3 bucket in the same region as SES.
Configure an S3 bucket policy that allows SES to write objects. This is where teams often fail: they give too broad permissions (risk/compliance issue) or too narrow permissions (silent failure).
AWS Verified Account for Sale In SES configuration set → Event destinations → choose S3. Set the bucket and event types (bounce/complaint).

Operational note

If you choose S3, set up an event-driven consumer (S3 event notifications → Lambda/SQS) so that bounces/complaints can trigger suppression within minutes—not days.

Verification and KYC considerations that affect notifications and sending

AWS Verified Account for Sale You didn’t ask “how to verify my SES account,” but in practice your ability to send (and generate bounces/complaints events) depends on verification state and risk review. As an operator, you’ll often discover problems only after you enable notifications.

Common roadblock during identity/KYC: sending restrictions

New AWS/SES account with limited history: sending volume and domain patterns trigger automated risk checks. You may receive fewer events initially because sending is throttled/restricted.
Payment method mismatch: if your billing method and tax identity don’t align, some accounts get delayed approvals for higher throughput.
Identity domain verification incomplete: SES can be configured, but sending is blocked until DNS/SPF/DKIM requirements are met.

Practical mitigation

Finish domain verification and ensure SPF/DKIM are correct before you expect meaningful complaint signals.
Start with low volume and monitor bounce/complaint rates early. If you see spikes, do not scale; fix the list quality and content.
Keep your configuration set mapping consistent so events correspond to the same domain and sending identity.

Risk control: what to do with bounce/complaint data (so you don’t get stuck)

Notification setup is not the end goal. The goal is to prevent repeat problems that trigger account reputation damage. Here’s how I typically implement suppression and incident handling.

Use reason codes to drive different actions

Bounces and complaints have different operational meaning:

Hard bounce: usually remove/suppress the recipient immediately. Keep them out of future sends, and re-check your list source.
Soft bounce: consider temporary suppression and retry policy only if the reason suggests transience. Over-aggressive retries can inflate bounce rate and worsen risk signals.
Complaint: unsubscribe/suppress immediately and stop sending to that mailbox. Complaints are typically more damaging than bounces.

Build an “event-to-suppression” workflow

A practical pattern:

Receive bounce/complaint notifications (SNS/S3).
Parse recipient address + reason.
Write to a suppression table with event type + timestamp + reason.
Update your sending service to check suppression before every send.
AWS Verified Account for Sale Trigger alerts when rates exceed thresholds.

Teams that only store events for later analysis usually miss the operational window—your sending continues to hit problematic addresses. That’s when account reviews can get triggered, especially if complaints rise.

Cost comparisons: SNS vs S3 in real operational terms

Costs vary by volume, region, and how you consume events, but the decision usually boils down to “streaming vs archival.”

AWS Verified Account for Sale SNS approach (best for real-time processing)

Pros: faster event handling, easier multi-subscriber setup (e.g., logging + suppression worker).
Cons: you may pay per notification delivery and for downstream processing (SQS/Lambda).
AWS Verified Account for Sale When it’s worth it: you have enough sending volume that you need near-real-time suppression.

S3 approach (best for audit + cheaper storage)

Pros: cheaper long-term retention; straightforward compliance logging.
Cons: unless you add an event-driven consumer, it’s not naturally real-time.
When it’s worth it: you want to retain raw event payloads and process them with a scheduled job, while keeping suppression logic time-bounded via Lambda/SQS.

AWS Verified Account for Sale If you’re currently considering buying an AWS/SES-capable account (some teams do when they need quicker access), remember: notification pipeline configuration is still your responsibility. You should validate the account’s IAM permissions, billing status, and region readiness before you invest engineering time.

Account purchasing / provisioning realities (what I check before enabling notifications)

Some users reach this guide after purchasing an AWS account (or receiving an organization account from a reseller). SES notifications won’t save you from a compromised account setup. Before you connect SNS/S3 destinations, check:

Billing active: SES sending and some features depend on billing status and limits.
Region access: ensure the SES region you plan to use is enabled under the account/org SCP policies.
IAm role permissions: the SNS topic policy and any KMS keys must be accessible.
CloudWatch/IAM restrictions: if the org blocks role assumptions or denies write access, events may fail to flow.

In risk control terms, I also look at whether the domain used for sending matches verification records, and whether SPF/DKIM are correctly set. Notifications without correct identity still won’t prevent deliverability and risk issues.

Funding and renewals: how they indirectly impact your notification visibility

SES notifications are “firehose” style—if sending stops or throttles due to account/billing issues, you’ll see fewer event deliveries. Two things often surprise teams:

Payment method problems can pause sending: even if your notification pipeline is configured, no new events arrive if sends fail.
Renewal timing: when billing renews late, the system may throttle or temporarily restrict non-compliant usage. That shows up as “no bounce events,” which looks like success—but it’s actually inactivity.

If you use different payment methods (card vs invoicing vs other billing arrangements), document which one is active and when. During early rollout, I recommend keeping a stable billing method to avoid interruptions that complicate incident diagnosis.

Common “why don’t I receive notifications?” troubleshooting

Here’s the list I use when debugging in production after a misconfiguration. This is the section most users need.

1) SNS subscription isn’t receiving messages

Confirm SNS topic has a subscriber (e.g., SQS/Lambda/email endpoint).
If it’s SQS: ensure the queue policy allows SNS to send.
Check dead-letter queue (DLQ) if configured; messages might be stuck.

2) SES can’t publish to SNS (policy mismatch)

Validate the topic access policy references the right aws:SourceAccount and aws:SourceArn.
Confirm SES and SNS are in the same region.
Re-check principal: the policy must allow SES service principal usage.

3) Event destination is attached to the wrong configuration set

Make sure your sending application uses the same configuration set name.
If you send via API, verify the ConfigurationSetName is correctly passed.

4) You turned on notifications, but you don’t see events yet

AWS Verified Account for Sale Complaints may be delayed; bounces also depend on SMTP response timing.
No events is not always “working”—check if sending is actually happening and not blocked.
If you recently verified a domain, allow time for reputation warm-up and DNS propagation.

5) S3 bucket policy or ownership controls block SES writes

If S3 uses Object Ownership settings, ensure the bucket policy permits SES writes as intended.
Verify bucket policy includes the SES principal/service and correct conditions.

Operational best practices (so complaints don’t spiral)

The most expensive SES setups are the ones that work technically but fail operationally. Use these guardrails once you start receiving bounce/complaint notifications.

Rate-limited scaling: scale sending only when bounce/complaint rates remain stable.
Immediate suppression: complaints and hard bounces should stop future sends to those mailboxes.
Alerting: set alerts per configuration set and per sending identity; don’t rely on manual checks.
Separate pipelines: keep “event ingestion” separate from “message sending” so incidents don’t affect each other.
Keep payloads: store enough event metadata to debug (timestamp, recipient, reason codes, message IDs).

FAQ (real questions I’ve seen from teams setting this up)

Q1: Do I need both bounce and complaint notifications? Can I skip one?

AWS Verified Account for Sale You typically need both. Complaints are usually the earliest and most damaging signal. Bounces are critical for list hygiene and to prevent repeated delivery attempts. If you only monitor bounces, complaints can rise unnoticed until it’s harder to recover.

Q2: Can I use different notification destinations for different domains?

Yes, the clean way is to use configuration sets per sending domain/use-case, each mapped to its own destination. This avoids mixing event streams when you operate multiple brands or IP reputations.

Q3: How do notifications relate to account risk control reviews?

SES risk reviews are driven by sending behavior and reputation signals, not only by whether notifications are enabled. However, good notification handling reduces repeat offenders (complainers/hard bounce recipients) quickly. That operational response can be the difference between a stable account and a prolonged restriction.

Q4: Does identity verification (KYC/verification) delay event notifications?

It can. If sending is blocked due to identity/billing/risk restrictions, there will be little to no traffic, hence fewer bounce/complaint events. Make sure sending is allowed in the same region with the same verified identity you configured in your configuration set.

Q5: What about “cost gotchas” when volume increases?

The event volume can spike during list issues (e.g., a broken CSV import). With SNS→SQS→Lambda, you’ll see scaling cost. With S3, storage costs rise based on retention. The best move is to build suppression immediately and keep retention reasonable while you’re in rollout.

Action plan: from zero to stable notifications in one session

Pick your SES region and verify your domain identity.
Create a configuration set dedicated to your main sending identity (or per brand).
Configure event destinations (SNS recommended; S3 if you need audit-first storage).
Validate permissions (SNS topic policy / S3 bucket policy) and test ingestion using a controlled send.
Implement suppression + alerting logic before scaling volume.
Monitor bounce/complaint rates; if anomalies occur, pause scaling and remediate list/content promptly.

If you tell me your current setup—SES region, whether you’re using SNS or S3, and how your sending app is structured (API/configuration set name)—I can provide a concrete policy/payload parsing checklist tailored to your environment and help you avoid the most common permission and region mismatch traps.