Amazon SES Warmup: From Sandbox Checks to a Verified Sender

Amazon SES gives you the sending infrastructure; a warmup plan helps you introduce the sender gradually and observe what happens along the way. The first useful milestone is a verified delivery through the SES region you intend to use.

This guide connects an Amazon Simple Email Service sender to MailSlurp using SES SMTP credentials. We'll work through the regional checks, the sandbox restriction that often interrupts a first test, and the evidence to review once scheduled sending begins.

Keep the SES region consistent

An SES setup has several moving parts that can look correct individually while belonging to different regions. Let's put them in one place before connecting the sender.

Detail	What to confirm
Sending region	The region your application or campaign will actually use
Verified identity	The intended sending address or domain is verified there
SMTP endpoint	The endpoint for that region
SMTP credentials	Credentials created for that region
Account status	Sandbox or production access in that region

AWS documents these boundaries in its regional SES guidance. A verification or production-access change in one region should not be assumed to apply to another.

For a custom domain, the provider's identity setup and the message's SPF, DKIM and DMARC results also deserve a check. A received test message is useful evidence of the actual configuration. The email header analyzer can help read it.

Why the SES sandbox matters for warmup

An account in the SES sandbox can send only to verified recipient identities or the SES mailbox simulator. AWS currently also limits sandbox sending to 200 messages in 24 hours and one message per second. Those restrictions apply per region. See AWS's production-access instructions for the current rules and request process.

Warmup sends to MailSlurp-managed destinations. Production access removes the sandbox recipient-verification restriction, so it's the normal prerequisite for this workflow. The From identity still needs verification afterward.

A simulator success can help test SES behavior, but it doesn't show where Gmail or Outlook put a message. That requires an observation at the destination mailbox. Similarly, production access is permission to send under the account's limits; it isn't evidence that every message will reach an inbox.

If your account is still in the sandbox, the SES administrator can complete the production-access request for the intended region before you continue. The request should accurately describe the real mail stream, recipient consent and handling of bounces and complaints.

Connect SES to MailSlurp

MailSlurp's SES connection uses the SMTP interface. The credential is an SES SMTP username and SMTP password, rather than an AWS console password or a raw AWS secret access key. AWS explains the distinction and regional credential creation in its SMTP credentials documentation.

1. Open Email warmup in MailSlurp and select Create warmup.
2. Choose Amazon SES, or select an existing verified SES sending connection.
3. Use the regional SMTP endpoint, port 587 and STARTTLS.
4. Enter the SES SMTP credentials and authorized From identity.
5. Verify the credential and complete the test delivery.
6. Choose the goal, schedule, available coverage and content, then create and start the program.

The endpoint follows email-smtp.<region>.amazonaws.com; for example, email-smtp.us-east-1.amazonaws.com is the US East (N. Virginia) endpoint. The example is only appropriate when that is your intended region. The MailSlurp SES connection reference keeps the required fields together.

MailSlurp submits through this customer-owned SMTP connection. It does not assume an AWS role for the sender.

Reading an SES error without guessing

SES responses help separate account setup from delivery behavior. These examples are summarized from AWS's SMTP troubleshooting reference:

Response	Likely next check
535, invalid authentication credentials	Confirm the SMTP credential type and region
554, identity not verified	Check the named identity in the response; sandbox recipients can also trigger this
554, access denied	Ask the SES administrator to review the credential's sending authorization
454, daily quota or maximum rate exceeded	Review account usage and the specific limit reported

The response text distinguishes errors that share a number. Keeping it with the test timestamp saves a second round of detective work. After the underlying issue is corrected, a fresh MailSlurp verification and test delivery confirms the connection is usable.

Increasing warmup volume doesn't resolve a rejected identity or a quota error. A temporary pause gives the owner room to investigate without adding more failed attempts.

Plan warmup alongside the mail SES already sends

An account may also send password resets, receipts and campaigns. The warmup schedule is one contributor to that workload, so the SES owner and the person running warmup need a shared view of expected activity.

This manual worksheet is a useful starting point. It doesn't require copying credentials or customer addresses:

SES region and verified From domain:
Production access confirmed by / date:
Other applications sending in this region:
Expected routine traffic and upcoming campaign:
Warmup current volume / target / local window:
SES quota or error requiring a review:
Latest completed MailSlurp placement observation:
Next decision and owner:

MailSlurp's Sender readiness view shows accepted versus planned sends for today, the next send and an adaptive pacing explanation. The program's placement view adds checkpoint results when coverage is available. Your SES account observations supply the other side of the review: account restrictions, errors and production feedback.

Warmup settings and SES account limits answer different questions. The former describe your program; the latter constrain what the provider permits. Neither alone establishes a safe campaign volume.

Before the first larger send

A completed warmup gives you a history to review. The upcoming campaign still deserves an inbox placement test using its actual message and sending route. Its HTML, links and tracking can differ from the plain-text warmup content.

For dedicated infrastructure, IP preparation is a further consideration. Our IP warmup versus domain warmup guide explains that distinction without treating every SES sender as the owner of a dedicated IP.

To begin, create a MailSlurp account, connect the verified SES sender and complete a test delivery. From there, the warmup results guide helps turn the observations into a decision about the next send.