Amazon SES (BYO) connection status and troubleshooting
When you set up an Amazon SES (BYO) sender profile, the SES identity domain, configuration set, SQS queue, region, and credential you enter must match your AWS account exactly. If anything is off, the connection will fail and the profile won't send email.
This article covers how to read that connection status and resolve errors. For steps on creating a sender profile, see Setting up a new Amazon SES (BYO) email sender profile. For a full walkthrough of the sender profile page, see Navigate an email sender profile page (Amazon SES BYO).
This article only applies to sender profiles using the Amazon SES (BYO) email provider.
Connection Status
When viewing your sender profile, the Details section shows the current status alongside its core configuration — name, description, channel, category, provider, and API name.
Status |
What it means |
|---|---|
Active |
The connection is healthy. The profile is ready to use in flows. |
Error |
The connection has failed and sending has been paused. All flows using this sender profile enter an error state. The profile won't send email until resolved. |
Pending |
The connection is awaiting verification and hasn't been confirmed either way yet. Treat it as not-ready for flows until it resolves to Active. |
Deactivated |
The sender profile has been manually deactivated (see Deactivating a sender profile below). It won't send email, and flows referencing it show as Terminated. |
If a sender profile has errored, an inline banner on the Details section of the sender profile page links straight to the full error, shown under Amazon SES configuration.
While a sender profile is in Error, the Update buttons on Sender details and Email configuration are disabled until the connection is reset.
Send test email
Use Send test email on the sender profile page to validate end-to-end sending through your AWS role. It's disabled while the connection status is Error — reset the connection first, then send a test to confirm delivery is working before you activate.
Resolving a connection error
- Find the error. Open the sender profile detail page. The error is shown in the Details section and repeated in full under Amazon SES configuration.
- Fix it in AWS. Use the error reference below to identify what needs to change and make the fix in your AWS account.
- Reset the connection. On the sender profile view page, click Reset connection. This re-runs the connection check against your AWS account.
- Validate with a test email. Once the connection check passes, use Send test email (see above) to confirm end-to-end sending is working.
- Activate. The profile is healthy and ready to use in flows.
If you make changes to your AWS configuration after a sender profile has been verified, the platform won't automatically detect this. Use Reset connection to manually re-check.
AWS configuration errors
When a sender profile connection fails, the platform displays the specific error returned by AWS. These errors originate in your AWS account configuration — the platform surfaces them so you have the information needed to fix them without raising a support ticket.
If you see an error on your sender profile, find it in the table below and follow the steps to resolve it in your AWS account.
The list below covers common examples — it isn't exhaustive. If you see an error that isn't listed here, the error message itself and the AWS documentation for the relevant permission or setting are the best next step.
Error |
What it means |
What to do in your AWS account |
|---|---|---|
sts:AssumeRole denied |
The platform cannot assume your IAM role. The trust policy is likely referencing an outdated platform role ARN. |
Update the trust policy in your AWS account to the current platform role ARN. |
ses:SendRawEmail missing |
The IAM role is missing the permission the platform needs to send email on your behalf. |
Add |
ses:GetConfigurationSet missing |
The IAM role is missing the permission to read your SES configuration set. |
Add |
ses:GetSendQuota missing or scoped incorrectly |
This permission must have Resource set to |
Update your IAM policy: set Resource to |
SES identity ARN casing mismatch |
The SES identity ARN in your IAM policy contains uppercase characters. AWS requires lowercase. |
Update the resource ARN in your IAM policy to lowercase. |
SES sandbox mode |
Your AWS SES account is in sandbox mode. AWS only allows sending to verified addresses. |
Request production access in AWS SES to move out of sandbox mode. |
SQS KMS decryption failure |
Your SQS queue has SSE-KMS encryption enabled. This configuration is not supported for customer managed SES. |
Switch your SQS queue to SSE-SQS (default) encryption. SSE-KMS is not supported. |
Multiple SQS consumers |
Another process is reading from the same SQS queue. The platform is not receiving the events it needs. |
Ensure no other process is consuming from this queue. Check for old or deactivated sender profiles pointing to the same queue. |
Known limitations
Domain status, DKIM status, mail from setup, bounce rate, and spam complaint rate aren't available for customer managed SES sender profiles. These rely on events that aren't natively available when using your own SES account.
Post-verification AWS configuration changes aren't automatically detected. Use Reset connection to manually re-check.
Send test email is unavailable while the sender profile is in an Error state.
In-product guidance points to the specific AWS error. If you don't manage the AWS account yourself, share the error detail and this article with whoever does.