How do I troubleshoot SMTP connectivity or timeout issues with Amazon SES?

Last updated: 2021-02-17

My Amazon Simple Email Service (Amazon SES) Simple Mail Transfer Protocol (SMTP) is timing out. How do I resolve SMTP connectivity or timeout errors with Amazon SES?

Resolution

Timeout connections typically indicate that your client is unable to establish a TCP connection to the public Amazon SES endpoint. To resolve SMTP connectivity or timeout errors with Amazon SES, first troubleshoot the application's TCP connection. If the TCP connection is successful, then troubleshoot the SSL/TLS negotiations.

Important: By default, Amazon Elastic Compute Cloud (Amazon EC2) restricts Amazon Virtual Private Cloud (Amazon VPC) egress traffic on port 25 for all EC2 instances. If your application requires traffic on SMTP port 25, you can request to remove this restriction.

Troubleshoot the application's TCP connection

1.    Run the following telnet or netcat (nc) commands, replacing email-smtp.us-east-1.amazonaws.com with the Amazon SES SMTP endpoint that you're using:

telnet email-smtp.us-east-1.amazonaws.com 587
telnet email-smtp.us-east-1.amazonaws.com 25
telnet email-smtp.us-east-1.amazonaws.com 465

nc -vz email-smtp.us-east-1.amazonaws.com 587
nc -vz email-smtp.us-east-1.amazonaws.com 25
nc -vz email-smtp.us-east-1.amazonaws.com 465

2.    Note the output.

If the connection is successful, then the telnet command returns an output similar to the following:

Trying 35.170.126.22...
Connected to email-smtp.us-east-1.amazonaws.com.
Escape character is '^]'.
220 email-smtp.amazonaws.com ESMTP SimpleEmailService-d-A12BCD3EF example0mJncW410pSau

Note: If the connection is successful, then proceed to the Troubleshoot SSL/TLS negotiations section below.

If the connection times out, then the telnet command returns an output similar to the following:

Trying 18.232.32.150...
telnet: connect to address 18.232.32.150: Connection timed out

Note: If the connection times out, then proceed to the next step.

3.    Confirm that your local firewall rules, routes, and access control lists (ACLs) allow traffic on the SMTP port that you're using. Also, confirm that your sending application has access to the internet.

For example, if you're using an Amazon EC2 instance to send emails and connect to the SMTP endpoint, then verify the following:

Troubleshoot SSL/TLS negotiations

If you're still having connectivity or timeout issues after troubleshooting the TCP connection, then check if there are problems with SSL/TLS.

1.    From an Amazon EC2 Linux instance, run the openssl command, replacing email-smtp.us-east-1.amazonaws.com with the Amazon SES SMTP endpoint that you're using:

Note: For Amazon EC2 Windows instances, see Test your connection to the Amazon SES SMTP interface using the command line and choose the PowerShell tab.

openssl s_client -crlf -connect email-smtp.us-east-1.amazonaws.com:465 
openssl s_client -crlf -starttls smtp -connect email-smtp.us-east-1.amazonaws.com:587

Note: If you've modified the location of the default certificate authority (CA), you might experience problems running these commands. Be sure to identify the location of the default CA bundle file when you installed openssl.

2.    Note the output. The expected responses are SMTP 220 and SMTP 250.

3.    If you don't get the expected output, then check the following:

  • Verify that the SSL/TLS certificate store is configured correctly.
  • Confirm that your sending application has the correct path to the certificate.
  • Verify that the Amazon SES certificate is installed on your server.

Note: You can test whether the correct certificates are installed. For instructions, see the About the Certificates section in About the Amazon Trust Services Migration.


Did this article help?


Do you need billing or technical support?