What Does "Whitelisting" Mean for Amazon SES?
Disambiguates a genuinely mixed-intent query, then walks through the real AWS production-access process with exact form fields.
"Whitelisting" Means Different Things in Amazon SES
If you searched for Amazon SES whitelist, you could mean one of three different things, and they have almost nothing to do with each other. Most people who land here mean the first one.
Getting your account out of the sandbox is the most common meaning. Amazon SES puts every new account in a sandbox that restricts you to sending to verified recipients only. Since you effectively have to whitelist every single recipient by hand until AWS approves you, people commonly call this whitelisting their SES account. This is what the rest of this guide covers.
SES identity-based sending policies are a separate, real Amazon SES feature that restricts which specific addresses or identities are allowed to send or receive through an account, configured through IAM or identity policies. If you are trying to lock down who can use your SES account rather than get approved to send more broadly, this guide is not about that.
A recipient's mail server allowlisting your sending IP is a third possibility. If you are trying to get a specific company's Office 365 or Google Workspace admin to stop blocking your cold email, that is a conversation with them about their own spam filter, not an AWS setting. Amazon SES has no control over another organization's allowlist.
What the Sandbox Actually Restricts
Every new Amazon SES account starts in the sandbox, independently in every AWS Region. While your account is in the sandbox, Amazon SES enforces three hard limits: you can only send to verified email addresses and domains, you are capped at 200 messages per 24-hour period, and you can send a maximum of 1 message per second. None of these are configurable from your side. They lift only when AWS moves your account to production.
Want every check on this page run automatically?
EmailQo runs SPF, DKIM, DMARC, blacklist, and content checks before every campaign — on your own Gmail, Outlook, or AWS SES sending account. Start the 7-day free trial, no card.
Start free trial →Requesting Production Access: The Exact Process
Production access is requested from the SES console's Account Dashboard, under Get set up, then Request production access. AWS asks for five specific things:
Mail type. Marketing, sent one-to-many to a list, or Transactional, sent one-to-one and triggered by a user action. Pick whichever describes most of what you will send.
Website URL. A link AWS uses to sanity-check that your described use case matches what your site actually does.
Additional contacts. Up to 4 email addresses to receive account communications.
Preferred contact language. English or Japanese.
Acknowledgement. A checkbox confirming you will only send to people who have explicitly requested your email, and that you have a process for handling bounce and complaint notifications.
AWS's stated response window is 24 hours for an initial reply. If they need more information before approving, that adds time on top.
If you are verifying a domain, not just an email address, before you request access, AWS explicitly recommends doing that first. AWS calls a verified domain identity a best practice that speeds up approval.
Why Requests Stall
AWS does not publish a list of rejection reasons, so treat this as informed inference from what the form itself asks for, not an official checklist. The acknowledgement checkbox and the website URL field are the two places reviewers have something concrete to check against. If your described mail type does not match what your website suggests you are sending, or your request does not make clear how recipients ended up on your list and how you handle bounces and complaints, that is exactly the kind of mismatch a manual reviewer flags for follow-up. Vague answers cost you the 24-hour window. Specific ones, like how you collect consent and what your bounce threshold trigger is, do not.
After Approval
Once you are in production, Amazon SES lifts the verified-recipient restriction and you can send to any valid address. You still have to verify any identity you use as a From, Source, Sender, or Return-Path address. Production access removes the recipient restriction, not the sender verification requirement. Initial production sending limits are typically modest and rise automatically as your sending history stays clean, meaning low bounce and complaint rates. You can request explicit quota increases through the same console once you need more.
Related Resources
Keep the guide close — get deliverability tips monthly
One short, useful email per month covering SPF/DKIM/DMARC pitfalls, warmup, and cold-email content. No spam. Unsubscribe anytime.
By subscribing you agree to receive occasional tips at this address. See our Privacy Policy. Unsubscribe anytime from any email or at /unsubscribe.
Keep reading