How to get out of the Amazon SES sandbox
What the Amazon SES sandbox limits, how to request production access step by step, what to write in the request, and what to do if AWS says no.
Sam 4 min read
Updated
On this page
To get out of the Amazon SES sandbox, verify a sending domain, then open the SES console in the region you send from and choose Request production access. Tell AWS what you send, who it goes to, how people signed up, and how you handle bounces and complaints. AWS usually answers within a day.
What the sandbox limits. You can send only to addresses and domains you have verified (and to the SES mailbox simulator), at most 200 messages in 24 hours, and at most one message a second.
What the SES sandbox is
Every new Amazon SES account starts in the sandbox, in every AWS region. It exists to stop new accounts being used for spam. Everything else works normally: you can verify domains, set up DKIM and send real email, as long as the recipient is an address you have verified.
The sandbox is per region. Production access in us-east-1 does nothing for eu-west-1, so ask in the region you will actually send from.
| In the sandbox | With production access | |
|---|---|---|
| Who you can send to | Verified addresses and domains, and the mailbox simulator | Anyone |
| Messages in 24 hours | 200 | A quota AWS sets for you, raised as you send well |
| Messages a second | 1 | A rate AWS sets for you |
Before you ask
A request from an account that already looks like a real sender is approved far more easily. Do these first:
- Verify a domain, not just an address. Set up DKIM and a custom MAIL FROM so SPF and DMARC pass. Our guide to SPF, DKIM and DMARC walks through the records.
- Have a working website on that domain. AWS looks at the address you give. It should make clear who you are, and how people join your list.
- Know your numbers: roughly how many emails a day, and how many a second at the busiest moment.
- Send a few test emails to verified addresses, so the account is not completely unused.
How to request production access
- Sign in to the AWS console and open Amazon SES.
- Pick the region you send from, in the top right corner.
- Open Account dashboard. A banner says your account is in the sandbox.
- Choose Request production access.
- Choose the mail type: marketing or transactional. Pick the one that describes most of your mail.
- Enter your website URL and describe your use case.
- Acknowledge the AWS Service Terms and Acceptable Use Policy, and submit.
What to write in the request
The use case description decides the outcome. AWS wants to know that people asked for your email and that you will look after your list. Answer these four questions in plain sentences:
- What do you send, and how often? "A monthly product newsletter and order confirmations."
- Who receives it, and how did they sign up? "Customers who created an account on our site and ticked a box to receive news. We do not buy or rent lists."
- How do people unsubscribe? "Every marketing email has an unsubscribe link, and requests are honoured immediately."
- How do you handle bounces and complaints? "Bounced and complained addresses are removed automatically and never emailed again."
Be specific and honest. A vague request ("we want to send emails to our users") is the most common reason for a refusal.
Do not ask for more than you need. A new account asking for a million emails a day looks like a bulk mailer. Ask for what you send today with some room, and request an increase later.
If AWS says no
A refusal is not final. Reply to the same support case with the detail that was missing: where the sign-up form is, a sample of the email, how unsubscribes work. If the website was thin when you applied, improve it first and say so. Starting a new account to try again makes things worse, not better.
After you are out
Production access comes with a daily quota and a rate that grow as you send good mail. Start below your quota and build up over a few weeks rather than sending everything on day one. Watch two numbers in the SES console: AWS advises keeping your bounce rate under 2% and your complaint rate under 0.1%, and reviews accounts that go well above those. Keeping your list clean is how you stay under them.
Glai shows whether your connected SES account is still in the sandbox, lets you verify test recipients from inside the app while you wait, and reads your daily quota and send rate from AWS. SES charges per email sent, with no monthly minimum: the current price is on our pricing page.
Questions people ask
How long does SES production access take?
AWS says it replies within 24 hours. A complete request is often approved sooner. An incomplete one gets a reply asking for more detail, which adds a day or two.
What are the SES sandbox limits?
In the sandbox you can send to verified addresses and domains and to the mailbox simulator only, up to 200 messages in 24 hours and one message a second.
Is production access per region?
Yes. Each AWS region has its own sandbox. Request production access in every region you send from.
Can I test my setup while still in the sandbox?
Yes. Verify the addresses you want to test with, or use the SES mailbox simulator addresses, which act out a delivery, a bounce and a complaint without affecting your reputation.
Why was my production access request denied?
Usually because the request did not explain how recipients opted in or how bounces and complaints are handled, or because the website gave no sign of a real business. Reply to the case with that detail.
Connecting SES takes a few minutes: create a free Glai account and follow the steps on the Sending page.