Cognito user pools email not receiving welcome message

Question

Hello,
our company has two Cognito user pools, one that is there for 2 years now and was working smoothly, one more recent and related to our customers. Some days ago we subscribed about 7000 users to the customers pool and we began to face some problems about welcome message (temporary password) receiving. The pools are configured to:
1. use email address as username to login;
2. all the email are sent through a production AWS SES with reserved IPs.

We receive, also, the bounce from SES through notifications via email. What we are facing is that some customers and some internals are whining about not receiveing verification codes and temporary passwords, so i decided to use SetLogNotificationConfiguration operation to add a cloudwatch group for each user pool. If i call the Get relative operation i get:

```
12:11 $ aws cognito-idp get-log-delivery-configuration --user-pool-id eu-central-1_*********
{
    "LogDeliveryConfiguration": {
        "UserPoolId": "eu-central-1_*********",
        "LogConfigurations": [
            {
                "LogLevel": "ERROR",
                "EventSource": "userNotification",
                "CloudWatchLogsConfiguration": {
                    "LogGroupArn": "arn:aws:logs:eu-central-1:***********:log-group:/aws/cognito-customers-production"
                }
            }
        ]
    }
}
```
but there are still customers and internals that are not receiving any email, but i receive no bounce from SES and no log in Cloudwatch. I tried, also, to use non existing emails for testing and i receive the bounce correctly and i see no log inside the cloudwatch about "userNotification" error events.
Is there any other way to understand what is going on? I tried with my private email and i receive, correctly, the welcome message in about 1 second
![Cloudwatch showing no logs](/media/postImages/original/IMIdz3IecgScyaVs5S8Iwe2g)

EDIT: a message sent yesterday, successfully, did not reach the recipient, the notification says

```
"delivery":{"timestamp":"2024-11-13T14:19:56.403Z","processingTimeMillis":747,"recipients":["****@*****"],"smtpResponse":"250 2.0.0 BEDstNr7aZyyLBEDstmDBz mail accepted for delivery","remoteMtaIp":"*******","reportingMTA":"****.smtp-out.eu-west-1.amazonses.com"}
```

re:Post Agent · Answer

It seems you're experiencing issues with email delivery for your Cognito user pools, particularly with welcome messages and temporary passwords. Based on the information provided, here are some potential reasons and steps to troubleshoot:

1. Email sending limits: Check if you've hit any email sending limits for your Amazon SES configuration. Even with reserved IPs, there might be daily sending quotas that could affect large-scale user subscriptions.

2. Email filtering: Some email providers might be filtering the messages as spam, especially if you're sending a large volume of similar messages in a short time. This could explain why some users receive the emails while others don't.

3. SES configuration: Ensure that your SES configuration is correctly set up for both user pools. Double-check the SourceArn parameter in your EmailConfiguration to make sure it's pointing to the correct SES identity.

4. Cognito email settings: Verify that the email settings in your Cognito user pools are correctly configured. Make sure the "EmailSendingAccount" is set to "DEVELOPER" if you're using your own SES configuration.

5. Log level: You've set the log level to "ERROR" for the CloudWatch logs. Consider changing it to "INFO" to get more detailed information about email sending attempts.

6. Message customization: If you've customized the welcome message, ensure that the template is correctly formatted and doesn't contain any issues that might prevent sending.

7. Email verification: For the emails that aren't being received, verify if they're correctly formatted and don't contain any typos.

8. SES production access: Confirm that your SES account is out of the sandbox mode if you're sending to email addresses that haven't been individually verified.

To further investigate:

1. Temporarily increase the log level to "INFO" for more detailed logging.
2. Use the AdminCreateUser API with MessageAction set to "SUPPRESS" to create a user without sending an email, then manually trigger a password reset to see if that email is received.
3. Check SES sending statistics and reputation metrics in the SES console.
4. Consider implementing a custom email sending solution using AWS Lambda and SES to have more control over the email sending process and logging.

If the issue persists after these checks, you may need to contact AWS Support for further assistance, as there might be underlying issues not visible through standard logging and configuration checks.  
**Sources**  
[AdminCreateUser - Amazon Cognito User Pools](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminCreateUser.html)  
[Email settings for Amazon Cognito user pools - Amazon Cognito](https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-email.html)  
[EmailConfigurationType - Amazon Cognito User Pools](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_EmailConfigurationType.html)  
[GetLogDeliveryConfiguration - Amazon Cognito User Pools](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetLogDeliveryConfiguration.html)

Cognito user pools email not receiving welcome message

Add your answer

Relevant content