I'm using a custom MAIL FROM domain to send email verification for a contact form

Question

I setup a custom MAIL FROM domain to send emails via SendMail from a lambda.  Say the email is admin@appmail.foo.com.  My domain is verified and the email sends correctly and the MX record shows 10 feedback-smtp.us-east-1.amazonses.com.  I then setup a SES forwarding lambda under SES Email receiving that should receive email from admin@appmail.foo.com - in case someone replies to the SendMail.  (they shouldn't because there is a verification link in that email, but people may decide to reply).  Under the Email Receiving I setup a ruleset where the recipient condition is appmail.foo.com and the Actions are 1) deliver to S3 bucket, 2) Invoke my lambda.   Since the MX records setup for appmail.foo.com pointed to feedback-smtp.us-east-1.amazonses.com, I changed it to inbound-smtp.us-east-1.amazonaws.com so that (theoretically) I could SendMail from admin@appmail.foo.com and receive any mail from the same address.   This worked for a day I could SendMail and my Lambda received email, then I got a notification from AWS "Amazon SES Custom MAIL FROM Domain Setup DISABLED in AWS Region..."  it would appear this is because the MX record no longer points to feedback. So, it appears you can't SendMail from the same email address where the Email Receiving points to because AWS is requiring feedback vs. inbound. What am I missing? How should I be setting this up?

Accepted Answer

So, I tracked this down myself, but thought it would be useful to post here. The issue is that you can't use the same domain to send *and* receive from.  So, when you send emails, it uses the feedback MX record.  The domain for that email - in my case appmail.foo.com is *only* used for sending, in the SendMail request, you need to add a Source: "admin@appmail.foo.com", but also a ReplyToAddresses (e.g. ["support@foo.com"] so that if someone replies, it goes to the alternate address - support@foo.com.   Now, let's say the email went to bob@bar.com.  You would want Bob to be able to unsubscribe.  Prior to the addition of extra email headers like Link-Unsubscribe (just announced https://aws.amazon.com/about-aws/whats-new/2024/03/amazon-ses-headers-sending-email/). For the person to unsubscribe, you had to put a link in the email.  Now, with SES v2 Sending APIs, you can include the Link-Unsubscribe header and have the response go to a Receiving subdomain like unsubscribe.foo.com - you could then attach a Lambda (https://aws.amazon.com/blogs/aws/new-receive-and-process-incoming-email-with-amazon-ses/) to that and process the unsubscribe.  Alternatively, use List Management new in SES V2 (https://docs.aws.amazon.com/ses/latest/dg/sending-email-list-management.html). The SES docs could be clearer in the introduction as to *why* the SendMail API is used and that it cannot receive email at the same address - thus the ReplyToAddresses.

I'm using a custom MAIL FROM domain to send email verification for a contact form

Relevant content