Why would this policy not work?

I have added a policy in which I've allowed a service acct identity to use VerifyDomainDkim. The gist of the permission= "Effect": "Allow", "Action": "ses:VerifyDomainDkim", "Resource": "arn:aws:ses::[acct-number]:identity/" I am using the same policy to VerifyEmailIdentity and to SendEmails. Those are working but VerifyDomainDkim is not. Using the .Net SDK, I get (One or more errors occurred. (User: arn:aws:iam::[acct-number]:user/[serviceacct] is not authorized to perform: ses:VerifyDomainDkim because no identity-based policy allows the ses:VerifyDomainDkim action))