---
title: "AWS SES Production Access: How to Get Out of the Sandbox"
description: "Request AWS SES production access step by step: the console form, the CLI call, what to prepare, how to track the review, and what to do if it stalls."
source: "https://www.mailmark.dev/blog/aws-ses-production-access"
site: "Mailmark"
---

# AWS SES Production Access: How to Get Out of the Sandbox

To get AWS SES production access, open the SES console in the region you send from, go to **Account dashboard**, choose **View Get set up page**, then **Request production access**, and submit the short form (mail type, website URL, contacts, and an acknowledgement). You can do the same from the CLI with `aws sesv2 put-account-details --production-access-enabled`. AWS says it gives an [initial response within 96 hours](https://docs.aws.amazon.com/ses/latest/dg/request-production-access.html), and the approval only applies to that one region.

Until then, your account is in the SES sandbox: you can only send to verified addresses, at most 200 messages per 24 hours and 1 per second. The rest of this guide covers what to set up before you ask, the exact form and CLI call, how to check the review from code, and what to do when the request stalls or gets denied.

> **Sending from your product domains? Skip your own sandbox request** Domains on Mailmark's infrastructure send through an SES account Mailmark already operates. Add the domain, publish the DNS records, and start sending without filing a production access request of your own. [Add your first domain](https://www.mailmark.dev/?utm_source=guide&utm_medium=seo&utm_campaign=aws-ses-production-access&utm_content=top)

## What the SES sandbox blocks

Every new SES account starts in the sandbox, and the [sandbox status is separate in each AWS Region](https://docs.aws.amazon.com/ses/latest/dg/regions.html). Here is what changes when you leave it, from the [AWS production access docs](https://docs.aws.amazon.com/ses/latest/dg/request-production-access.html):

| | Sandbox | Production |
| --- | --- | --- |
| Recipients | Verified addresses and domains, plus the mailbox simulator | Any address |
| Daily quota | 200 messages per 24 hours | Set for your use case |
| Send rate | 1 message per second | Set for your use case |
| Sending authorization | Delegates cannot send to unverified addresses | Normal |
| Account suppression list | Bulk actions and suppression list API calls disabled | Available |
| From, Sender, Return-Path | Must be verified | Still must be verified |

The last row trips people up. Production access removes the recipient restriction, not the sender one. You still need a verified identity for every From address in every region you send from. For domains you add to Mailmark, the [domain setup docs](/docs/domain-setup) list the DNS records that verify them.

Quotas count recipients, not messages: one email to 10 recipients uses 10 of your 200, according to the [sending quota docs](https://docs.aws.amazon.com/ses/latest/dg/manage-sending-quotas.html).

## Before you request: a checklist

The form takes two minutes, but a thin request is what gets questions back from the reviewers. AWS recommends verifying a domain first because it [gets requests approved faster](https://docs.aws.amazon.com/ses/latest/dg/request-production-access.html). Have these in place before you submit:

- **A verified domain identity** in the region you will send from, with its DKIM records published. If you are new to the records involved, the [DNS setup guide](/blog/dns-setup) walks through MX, SPF, DKIM, and DMARC.
- **Bounce and complaint handling that actually runs.** The form makes you confirm you have a process for bounce and complaint notifications. Point SES feedback at an SNS topic or an inbox ([setup docs](https://docs.aws.amazon.com/ses/latest/dg/monitor-sending-activity-using-notifications.html)) and make sure bounced and complaining addresses get removed from your lists.
- **A live website** at the URL you will enter, ideally on the same domain you send from, that shows what your product is and where people sign up.
- **An opt-in story.** Know how every recipient asked for your email (signup, purchase, password reset) and how they unsubscribe.
- **A list of regions.** Decide every region you will send from. Each one needs its own request, identities, and DKIM setup.

> **Region mismatch:** The most common "I was approved but I'm still sandboxed" case is a region mismatch. Your app sends through `eu-west-1` while the request was approved in `us-east-1`. Check the region in your SDK client or SMTP endpoint before anything else.

## Request production access in the console

From the [AWS procedure](https://docs.aws.amazon.com/ses/latest/dg/request-production-access.html):

1. Open the [SES console](https://console.aws.amazon.com/ses/) and switch to the region you want to send from.
2. In the navigation panel, choose **Account dashboard**.
3. In the "Your Amazon SES account is in the sandbox" box, choose **View Get set up page**, then **Request production access**.
4. Pick **Marketing** or **Transactional**, whichever describes most of your mail (the table below helps).
5. Enter your **Website URL**.
6. Under **Additional contacts**, add up to 4 addresses that should hear about your account.
7. Choose a **Preferred contact language** (English or Japanese).
8. Tick the **Acknowledgement** that you only send to people who asked for your email and that you handle bounces and complaints.
9. Choose **Submit request**.

AWS opens a support case for the review automatically. You can't edit the details while the review is open.

### Marketing or Transactional?

| You mostly send | Choose |
| --- | --- |
| Password resets, receipts, signup confirmations, alerts triggered by a user action | Transactional |
| Newsletters, product announcements, promotions to a list | Marketing |
| Both, but most volume is app notifications | Transactional |
| Both, but most volume is campaigns | Marketing |

AWS defines transactional mail as one-to-one and triggered by a user action, and marketing mail as one-to-many promotional content. Pick the one that matches the majority of what you send. A mismatch between your answer and your website is an easy reason for a reviewer to ask questions.

## Request it with the AWS CLI

The CLI is handy if you script account setup or need several regions. The [`put-account-details` reference](https://docs.aws.amazon.com/cli/latest/reference/sesv2/put-account-details.html) lists `--mail-type` and `--website-url` as required. It also accepts an optional `--use-case-description` of up to 5,000 characters, which the console form no longer asks for:

```bash
aws sesv2 put-account-details \
  --region us-east-1 \
  --production-access-enabled \
  --mail-type TRANSACTIONAL \
  --website-url "https://example.com" \
  --contact-language EN \
  --additional-contact-email-addresses ops@example.com \
  --use-case-description "$(cat ses-use-case.txt)"
```

Run it once per region, changing `--region` each time.

### A use case description you can adapt

Reviewers want to know what you send, to whom, how those people opted in, and what happens when an address bounces or complains. Here is a worked example for a typical SaaS app. Replace the placeholders with your real details; do not submit claims you can't back up.

```text
[App name] (https://example.com) is a [what it does] for [who uses it].
We send transactional email only: account verification, password resets,
receipts, and alerts the user configures. Every recipient is a registered
user who created an account and verified their address.

Expected volume: about [N] emails per day in this region.

Sending domain: mail.example.com, verified in SES with DKIM. SPF and DMARC
are published.

Bounces and complaints: SES notifications go to an SNS topic. A worker
suppresses hard-bounced and complaining addresses immediately so we never
send to them again. Users can turn off non-essential notifications in
their settings, and marketing email is not sent from this account.
```

## Check the review status from code

The console shows a banner, but the API tells you more. [`GetAccount`](https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_GetAccount.html) returns whether production access is on, the open review's status and case ID, your quota, and your reputation status. With the AWS SDK for JavaScript v3:

```ts
import { SESv2Client, GetAccountCommand } from "@aws-sdk/client-sesv2";

// Sandbox status is per region, so check every region you send from.
const regions = ["us-east-1", "eu-west-1"];

for (const region of regions) {
  const ses = new SESv2Client({ region });
  const account = await ses.send(new GetAccountCommand({}));

  console.log(region, {
    production: account.ProductionAccessEnabled,
    review: account.Details?.ReviewDetails?.Status, // PENDING | GRANTED | DENIED | FAILED
    caseId: account.Details?.ReviewDetails?.CaseId,
    max24h: account.SendQuota?.Max24HourSend,
    perSecond: account.SendQuota?.MaxSendRate,
    reputation: account.EnforcementStatus, // HEALTHY | PROBATION | SHUTDOWN
  });
}
```

Or from a shell: `aws sesv2 get-account --region us-east-1`.

Mailmark's [bring-your-own-AWS connection](/docs/byo-aws) runs the same `GetAccount` check when you connect an account and shows an SES sandbox badge until production access is on.

The [`ReviewDetails` status values](https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_ReviewDetails.html) mean:

| Status | Meaning | What to do |
| --- | --- | --- |
| `PENDING` | Under review | Wait, and watch the case for questions |
| `GRANTED` | Approved | Confirm `ProductionAccessEnabled` is `true` in that region |
| `DENIED` | Not approved | Reply on the case with the missing details (see troubleshooting) |
| `FAILED` | AWS didn't receive the request | Submit it again |

While you wait, you can still test your full pipeline. The [SES mailbox simulator](https://docs.aws.amazon.com/ses/latest/dg/send-an-email-from-console.html) works in the sandbox, and mail to `success@simulator.amazonses.com`, `bounce@simulator.amazonses.com`, or `complaint@simulator.amazonses.com` doesn't count against your daily quota or your reputation metrics. It's a good way to prove your bounce and complaint handling works before a reviewer asks.

> **Running SES in your own AWS account?** Connect it to Mailmark with bring-your-own-AWS. The CloudFormation stack wires SES bounce and complaint notifications into Mailmark, and the dashboard flags the account if SES is still in the sandbox. [Connect your AWS account](https://www.mailmark.dev/?utm_source=guide&utm_medium=seo&utm_campaign=aws-ses-production-access&utm_content=middle)

## Troubleshooting

| Symptom | Likely cause | Fix |
| --- | --- | --- |
| `MessageRejected: Email address is not verified. The following identities failed the check in region ...` | The account is still sandboxed in that region, or a From or Return-Path address isn't verified there | Check `ProductionAccessEnabled` in that exact region, and verify the sending identity in that region |
| Approval email arrived, sends still fail | Your app sends from a different region than the one approved | Match the SDK or SMTP region to the approved one, or request access in the other region |
| No answer after 96 hours | Reviewers asked a follow-up question on the case | Open Support Center, find the case from `ReviewDetails.CaseId`, and reply |
| Status is `FAILED` | AWS never received the request | Submit the request again |
| Status is `DENIED` | The request didn't show a clear opt-in, content, or bounce handling story | Reply on the case with specifics: how recipients sign up, sample content, volume, and how bounces, complaints, and unsubscribes are handled |
| Throttling or quota errors after approval | You're above your new daily quota or send rate | Read `SendQuota` from `GetAccount`, then [request an increase](https://docs.aws.amazon.com/ses/latest/dg/manage-sending-quotas-request-increase.html) |
| Sending from EC2 over port 25 times out | EC2 throttles port 25 by default | Use port 587 or 465 for SMTP, or [ask AWS to lift the throttle](https://repost.aws/knowledge-center/ec2-port-25-throttle) |

### Keeping production access once you have it

Approval isn't permanent if your metrics slip. From the [SES sending review FAQ](https://docs.aws.amazon.com/ses/latest/dg/faqs-enforcement.html):

- **Bounces:** keep the rate below 2%. At 5% AWS places the account under review, and at 10% it may pause sending.
- **Complaints:** keep the rate below 0.1%. At 0.1% the account goes under review, and at 0.5% sending may be paused.

Only hard bounces to addresses on domains you haven't verified count toward the bounce rate. The cheapest ways to stay under those numbers are to remove hard-bounced addresses immediately and to check addresses before the first send. If you're switching providers to SES and want to see the cost difference first, the [SES savings calculator](/tools/ses-savings-calculator) compares your volume across providers.

## Frequently asked questions

### How long does SES production access take?

AWS says it gives an initial response within 96 hours of your request. If the reviewers need more information from you, it takes longer, so answer their follow-up on the Support Center case quickly.

### Is SES production access per region?

Yes. Sandbox status, sending quotas, and verified identities are all separate per AWS Region. Request production access in every region you send from; one Support Center case can cover several regions.

### Do I still need to verify my domain after I get production access?

Yes. Production access lets you send to unverified recipients, but every address or domain you use as From, Source, Sender, or Return-Path must still be a verified identity in that region.

### Does production access raise my sending quota?

It removes the sandbox cap of 200 messages per 24 hours and 1 per second. The new quota and rate depend on your use case, and you can ask for a higher quota in the same request or later through AWS Support.

### What should I do if my SES production access request is denied?

Reply on the Support Center case for the request (its ID is in GetAccount under Details.ReviewDetails.CaseId) with the specifics a reviewer needs: how recipients opt in, what you send, and how you handle bounces, complaints, and unsubscribes.

> **Run every product's email from one place** Multi-domain mailboxes, automatic inbox warming, SPF, DKIM and DMARC monitoring, and automatic bounce suppression, all on top of SES. [Try Mailmark free](https://www.mailmark.dev/?utm_source=guide&utm_medium=seo&utm_campaign=aws-ses-production-access&utm_content=end)


Published 2026-10-22. Updated 2026-10-22. 7 min read.

---

Mailmark - email hosting and campaigns for your own domain. Canonical page: https://www.mailmark.dev/blog/aws-ses-production-access | [llms.txt](https://www.mailmark.dev/llms.txt) | [OpenAPI](https://www.mailmark.dev/openapi.json) | [sitemap](https://www.mailmark.dev/sitemap.xml)