Sending Email failed in Workmail

HI,

If anyone else comes across this problem, you can solve this by adding the domain again in the WorkMail console. This will trigger a workflow to check various setting for the domain and correct any problems.

Kind regards, Robin

I found the solution myself. Here are the steps:

1. Goto SES -> Verified identities -> click the domain that you want to send email
2. Goto Authorization -> Create Policy -> add the below policy
3. The resource name is the ARN of your domain

{ "Version": "2012-10-17", "Statement": [ { "Sid": "stmtxxxxxxx", "Effect": "Allow", "Principal": { "Service": "workmail.us-west-2.amazonaws.com" }, "Action": "ses:*", "Resource": "arn:aws:ses:us-west-2:xxxxxxx, "Condition": {} } ] }

Hello,

If you're experiencing difficulties while trying to send email from your WorkMail Organization and you're receiving an email back to your inbox containing an error message similar to the one below:

Your administrator needs to give permissions to WorkMail to perform e-mail sending on your behalf.

Please follow these steps:

1. From the AWS Console, go to Amazon SES.
2. In the side panel, locate Verified Identities (under Configuration) and navigate to this section.
3. Identify the Identity you're using to send email from WorkMail and open it by clicking on its name.
4. Click on the Create Policy button.
5. Click on Custom Policy.
6. Attach a policy like the one below:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AuthorizeWorkMail",
      "Effect": "Allow",
      "Principal": {
        "Service": "workmail.REGION.amazonaws.com"
      },
      "Action": [
        "ses:*"
      ],
      "Resource": "arn:aws:ses:REGION:AWS_ACCOUNT_ID:identity/WORKMAIL-DOMAIN-NAME",
      "Condition": {
        "ArnEquals": {
          "aws:SourceArn": "arn:aws:workmail:REGION:AWS_ACCOUNT_ID:organization/WORKMAIL_ORGANIZATION_ID"
        }
      }
    }
  ]
}

Note: you need customize the policy above by replacing REGION, AWS_ACCOUNT, WORKMAIL-DOMAIN-NAME and WORKMAIL_ORGANIZATION_ID with your own values .

Here is some additional documentation: https://docs.aws.amazon.com/workmail/latest/adminguide/editing_domains.html

Hope this helps