Not receiving AWS SNS confirmation email for group DL – not hitting email gateway

Please try on below:

1. Check group settings For Google Groups: o Ensure “Anyone on the web” can post to the group. o In the Admin Console, enable “Allow incoming email from outside the organization”. For Microsoft 365: o Confirm the group is mail-enabled and allows external senders. o Check transport rules or spam filters that might block AWS SNS.

2. Resend the confirmation • In the SNS Console, go to the subscription and click “Request confirmation”. • This re-triggers the confirmation email, though it won’t work if the endpoint is still blocked.

3. Use an individual email first • Subscribe a personal email to confirm the topic works. • Once confirmed, try forwarding messages from that email to the group DL as a workaround.

Mailboxes within an organization are often limited to internal traffic. Email messages which are published or sent using SNS use "no-reply@sns.amazonaws.com" as the source email. The recipients mail server must allow emails from this source. You can check with your email administrators to see if the no-reply@sns.amazonaws.com address is filtered out by a firewall or spam filter. You can also add the "no-reply@sns.amazonaws.com" address to your mailbox allow list.

In terms of your inquiries:

Can you help us identify:

1. Whether the confirmation email was actually sent from SNS.

You can check the numberOfNotificationsDelivered CloudWatch metric and check for an increment there every time you request confirmation on the pending email subscription. Requesting confirmation will not cause an increment numberOfMessagesPublished metric. This might not be a viable option if the SNS topic is a high traffic topic with high publish and delivery rates.

[+] https://docs.aws.amazon.com/sns/latest/dg/sns-monitoring-using-cloudwatch.html#sns-metrics

2. The message ID, timestamps, and destination email used.
3. Any logs or bounce/suppression data from the SNS side.

For 2 and 3(and even 1), you would need to open an AWS support case for Amazon SNS. The support team will be able to get you this information quickly. I would recommend opening a chat or a call so that you can test live. You would need to provide the SNS topic ARN(which would include your account id, region and the topic name), timestamps as well as the destination email address which is in pending confirmation state.

Would also recommend to set up authentication to unsubscribe so that members of the DL don't unsubscribe all recipients of your SNS topic email. You must have the required permissions to unsubscribe your email endpoint. You can use the Amazon SNS console or AWS CLI to confirm the subscription with an authenticated user.

[+] https://repost.aws/knowledge-center/prevent-unsubscribe-all-sns-topic