Why Are Amazon SES Emails Going to Spam?

Amazon SES emails usually go to spam for one of four reasons: your mail isn't aligned for DMARC because you never set up a custom MAIL FROM domain or Easy DKIM, your list has old or unconsented addresses, you're on a dedicated IP that's cold or sends too irregularly, or you're missing the unsubscribe headers Gmail and Yahoo now expect from bulk senders. SES is a delivery pipe, not a marketing platform, so far more of the setup is on you than with a typical ESP.

That last point is the theme of this page. SES does what you tell it, quickly and cheaply. It won't stop you from sending to a bad list or from skipping half the authentication.

How SES sends your mail

A few SES defaults explain most spam problems:

• Shared IPs by default. Unless you lease dedicated IPs, your mail goes out from a pool shared with other SES customers, and AWS manages that pool's reputation.
• The MAIL FROM domain is Amazon's. SES uses a subdomain of amazonses.com as the bounce (envelope sender) address unless you set your own. SPF passes, but for amazonses.com, not for you, so SPF does nothing for your DMARC.
• DKIM is yours to enable. Easy DKIM signs with your domain once you publish the CNAME records SES gives you, with 2048-bit keys by default.
• Reputation is enforced at the account level. SES watches your bounce and complaint rates and will put your account under review, or pause it, if they get too high.

The common causes, most likely first

1. DMARC doesn't align

DMARC passes when SPF or DKIM passes for a domain that matches your From address. With SES defaults, SPF is for amazonses.com, so only DKIM can save you, and only if Easy DKIM (or your own DKIM) is set up on the domain in your From address. If it isn't, Gmail and Yahoo see unauthenticated bulk mail, which they junk or reject. See DMARC fail: why it fails and how to fix it.

2. The list

SES will send to whatever addresses you hand it. Old exports, scraped addresses, purchased lists and form fills nobody confirmed bring spam traps, hard bounces and complaints. AWS recommends keeping your bounce rate below 2% and your complaint rate below 0.1%, and it puts accounts under review at 5% bounces or 0.1% complaints. Long before AWS notices, Gmail and Microsoft will have started filtering you.

3. Dedicated IPs that are cold or irregular

Standard dedicated IPs have to be warmed up gradually and then kept on a consistent sending pattern. AWS's own guidance is that ISPs only track an IP once it sees meaningful volume, and it suggests sending at least several hundred messages to each major provider within a 24-hour period at least once a month. An IP that sends one big campaign a month and sits idle otherwise never builds a reputation. AWS recommends shared IPs for low or irregular volume, or managed dedicated IPs, which warm up automatically per provider.

4. Missing one-click unsubscribe

Gmail and Yahoo expect marketing mail to support one-click unsubscribe through the List-Unsubscribe and List-Unsubscribe-Post headers. SES can add them through its subscription management feature when you send with a contact list and topic, or you can set the headers yourself. Raw SES sends without either have neither. See the Gmail and Yahoo bulk sender requirements.

5. Mixing mail types on one identity

Password resets and marketing campaigns going out from the same domain, IPs and configuration means a bad campaign drags your transactional mail down with it.

6. Content and links

Link shorteners, links to domains with a poor reputation, and image-only messages all count against you, just as they would on any platform.

How to fix it, step by step

1. Read the headers of a message that landed in spam. Paste them into the header analyzer and look at the Authentication-Results line: you want dkim=pass with header.d= your domain and dmarc=pass.
2. Turn on Easy DKIM for every domain you send from and publish the CNAME records. Use 2048-bit keys unless your DNS provider can't handle them.
3. Set up a custom MAIL FROM domain, a subdomain such as bounce.example.com that you don't use for anything else. It needs exactly one MX record pointing to feedback-smtp.<region>.amazonses.com and an SPF record of v=spf1 include:amazonses.com ~all. This gives you aligned SPF as a second path to DMARC. AWS notes it can take up to 72 hours for SES to detect the MX record.
4. Publish a DMARC record if you don't have one. Start at p=none with reporting, then work toward enforcement; the DMARC generator will build it. Run the domain through the email authentication checker afterwards.
5. Clean the list. Remove hard bounces and complainers (SES's account-level suppression list helps), drop anyone who hasn't engaged in months, and stop sending to anything purchased or unconfirmed.
6. Handle bounces and complaints in code. Subscribe to SES's bounce and complaint notifications and suppress those addresses automatically.
7. Add one-click unsubscribe to marketing mail, either through SES subscription management or your own headers and endpoint.
8. Separate mail streams. Use different configuration sets, and if you're on dedicated IPs, different IP pools, for transactional and marketing mail. A separate subdomain for marketing helps too.
9. Fix your IP strategy. If you're on standard dedicated IPs with irregular volume, move to the shared pool or managed dedicated IPs. If you just moved to dedicated IPs, warm them up gradually.

How to confirm it's fixed

Check the headers of a fresh test send for aligned DKIM and SPF and a DMARC pass. Watch your SES reputation metrics in the console, and watch Google Postmaster Tools and Microsoft SNDS for spam rate and IP status over the next couple of weeks. Inbox placement recovers gradually once the cause is fixed, not overnight.

How to keep it from coming back

• Treat bounce and complaint suppression as part of your application, not a cleanup chore.
• Keep sending volume consistent, especially on dedicated IPs.
• Re-check authentication whenever you add a new From domain or AWS region.
• Monitor reputation outside SES. The AWS console only shows you what AWS can see.

If the problem started abruptly after weeks of good delivery, Why are my emails suddenly going to spam? walks through what usually changed. Comparing platforms? See SendGrid and HubSpot.

When to get help

If your authentication checks out and mail is still landing in spam, or your account is under review and you can't find the source of the bounces or complaints, it's worth bringing in someone who's untangled this before. Get in touch.

FAQ

Do I need a custom MAIL FROM domain if I have Easy DKIM?

Not strictly; aligned DKIM alone is enough for DMARC to pass. A custom MAIL FROM gives you aligned SPF as a backup, so a DKIM problem doesn't take your DMARC down with it.

Should I use dedicated IPs on SES?

Only if you send high volume on a regular, predictable schedule. AWS recommends the shared pool for low or irregular volume, and managed dedicated IPs if you want your own IPs but your volume varies.

What happens if my SES account goes under review?

You can keep sending while you fix the cause. If bounce or complaint rates aren't fixed before the review period ends, or they're severe, AWS can pause your sending.

Does SES warm up IPs for me?

Only managed dedicated IPs warm up automatically. Standard dedicated IPs have to be warmed up by gradually increasing volume yourself.