How do I troubleshoot an Amazon SES configuration set that isn't working?

Last updated: 2022-08-17

My Amazon Simple Email Service (Amazon SES) configuration set isn’t publishing the events that are specified in its rules. How do I troubleshoot this?

Resolution

Apply a configuration set

First, make sure that your configuration set is properly applied. To apply a configuration set to emails that you want to monitor, pass the name of the configuration set in the email header X-SES-CONFIGURATION-SET. For example:

X-SES-CONFIGURATION-SET: example_configuration_set_name

Be sure to replace example_configuration_set_name with the name of the configuration set that you want to use. Or, you can assign a default configuration set to a specific verified identity. This makes sure that messages that are sent from the identity use the assigned configuration set.

Note: If the verified identity in the FROM field has a default configuration that conflicts with a configuration set specified in the X-SES-CONFIGURATION-SET header, then the header’s configuration set takes precedence.

To troubleshoot configuration sets that aren't working, verify that the configuration set is passed in the headers of the relevant emails. For more information on passing the configuration set as a header when using different methods for sending emails, see Specifying a configuration set when you send email.

Amazon CloudWatch destination

If you have issues with an Amazon SES configuration set to publish metrics to Amazon CloudWatch, then verify that the value source is configured correctly:

  • Message tag: The message tag is a key-value pair that contains the dimension name that CloudWatch uses to pull events. For CloudWatch to detect the events, the tags must be specified as an email header using the X-SES-MESSAGE-TAGS header.
  • Email header: With this value source, Amazon SES retrieves the dimension name and values from the email headers. However, you can't use these email headers as the dimension names: Received, To, From, DKIM-Signature, CC, message-id, or Return-Path.
  • Link Tag: Link tags are key-value pairs. They’re used for publishing click events to CloudWatch for an email campaign that has embedded links. Be sure to verify that the link tag is configured correctly in both the embedded links and the configuration set.

Amazon Simple Notification Service (Amazon SNS) Destination

If you have issues with an Amazon SES configuration set to publish SES events to an SNS topic, then verify the following:

  • The SNS topic is a Standard type topic. SES doesn’t support FIFO type topics.
  • The SNS topic has an endpoint subscribed to the topic, and the correct endpoint is referenced for the published events.
    Note: Some endpoints have prerequisites that must be met before event publishing can begin. For instance, an Email/Email-JSON endpoint requires that you confirm the subscription before the email address can receive messages. Therefore, note the relevant requirements for each endpoint type while configuring your SNS topic.
  • SES has the required permissions to publish notifications to your topic.
  • If your SNS topic has encryption activated and uses an AWS KMS key, then verify that SES has the following KMS permissions on the key in use:
    kms:GenerateDataKey
    kms:Decrypt

Amazon Kinesis Data Firehose destination
If you have issues with an Amazon SES configuration set to publish SES events to a Kinesis Data Firehose, then verify the following:

  • The correct Delivery stream is being referenced for the published SES events.
  • The AWS Identity and Access Management (IAM) role that Amazon SES uses has permissions to publish to your Kinesis Data Firehose delivery stream.

Amazon Pinpoint destination

If you have issues with an Amazon SES configuration set to publish SES events to Amazon Pinpoint, note that Amazon Pinpoint doesn’t support Delivery delays or Subscriptions event types.


Did this article help?


Do you need billing or technical support?