AWS SES "MessageRejected" error in CI

By Daniel Zoghalchali·Latchkey

SES raises MessageRejected when the API request is well-formed and authenticated but SES will not send the message. The accompanying text says why: an unverified identity, a suppressed address, a paused sending state, or content that failed a check.

What this error means

A SES send returns MessageRejected with a reason string. Unlike a 4xx auth error, the credentials worked; SES chose not to deliver.

An error occurred (MessageRejected) when calling the SendEmail operation:
Address blacklisted.

Common causes

The recipient is on the suppression list

A prior bounce or complaint placed the address on the account-level suppression list, so SES rejects new sends to it.

The account or identity cannot send

A paused sending state, an unverified from identity, or a sandbox restriction leads SES to reject the message.

How to fix it

Read the reason and act on it

1. Note the reason string in the MessageRejected error.
2. For a suppressed address, remove it from the suppression list if delivery is expected again.
3. For an unverified sender, verify the identity or leave the sandbox.

aws sesv2 delete-suppressed-destination \
  --email-address team@example.com --region us-east-1

Confirm the account can send

Check the account sending status so a paused account is caught early.

aws sesv2 get-account --region us-east-1 \
  --query '{Enabled:SendingEnabled,Suppression:SuppressionAttributes}'

How to prevent it

• Monitor bounce and complaint rates so identities stay in good standing.
• Verify sending domains and keep the account out of the sandbox for CI.
• Handle suppression-list entries deliberately, not by blind retries.

Frequently asked questions

Related guides

References

• GitHub Actions documentation