S3 not saving emails from SES

Question

Hello, I have been unable to get SES to send emails to my S3 bucket. I first created 2 identities inside of the Amazon SES portal where the first was my Gmail which I verified and the second was my domain name which is also verified. After this I then set up all of the DNS configurations with my domain name. Secondly, I tested the 'Send test email' option where I was able to successfully send an email from contact@example.com to my verified Gmail. However, the issue I am having is that I can’t receive emails that are sent to contact@example.com despite setting up Email receiving. I tried sending emails using the built in system from my Gmail and from my domain then also tried sending emails from another Gmail that is unverified but none of these showed up inside my S3 bucket.

When looking at my identity for my domain I see that DKIM and MAIL FROM are marked with successful but there is no section for receiving mail here. Anyways because of this I decided to set up Email receiving. Here I created a new rule that is Enabled and set as Active where I have TLS required unchecked, Spam and virus scanning checked, and I made the recipient conditions 'contact@example.com'. Next, I selected the S3 bucket I created without message encryption.

Now for my S3 bucket I am using Block all public access since I was told this won’t affect AWS internal ability to send emails to my S3 bucket. The only thing I get showing up in my inbox is the occasional AMAZON_SES_SETUP_NOTIFICATION which just contains ASCII that mentions there was an issue without telling me what the issue was. I am not sure what causes this since not all emails cause this to pop up. Also, both SES and S3 use US East (N. Virginia) us-east-1. Anyways here is my bucket policy…

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "ses.amazonaws.com"
            },
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::email-contact-bucket/*"
        }
    ]
}
```
Also, I contacted my DNS provider and they said everything including the MX record looks correct. I also used online tools to verify that my MX records work, especially the inbound one which it does since I set up all my records over 48 hours ago. The MX records I created was the 'mail.example.com' where mail is the name and created another one with an @ as the name and example.com as the value so that way the MX record points directly to my domain name.

I have also experimented with setting up Mail Manager to handle sending emails but that still resulted in nothing being sent to my S3 bucket, so I just deleted all of that to reduce complexity. Anyways I would greatly appreciate any advice or debugging suggestions since I have been stuck on this for a bit now and desperately need to get things up and running.

Leo K · Accepted Answer

Ah, there's your problem. The MX record must point to
```
inbound-smtp.us-east-1.amazonaws.com
```
and not
```
inbound-smtp.us-east-1.amazonses.com
```

rePost-User-1808855 · Answer

I'm having the same issue, everything verified but no email is getting saved in the s3.
https://stackoverflow.com/questions/79422941/aws-ses-email-receiving-deliver-to-s3-doesn-t-work

Leo K · Answer

Where is your MX record pointing? It should point to `inbound-smtp.REGION.amazonaws.com`, such as `inbound-smtp.eu-west-1.amazonaws.com`.

To receive emails, you must verify the entire domain, and as you explained, you've done that. Verifying individual email addresses would only work for sending emails, not for receiving them.

The bucket policy is correct-ish, in that it is allowing emails to be delivered to S3, but only too well: anyone who knows or guesses the name of your bucket can set SES to deliver mails there, effectively injecting data of their choice into your reception process/pipeline. Also, the Block Public Access (BPA) setting will not interfere with SES's ability to deliver emails, and you should enable all the protection options of BPA. You should restrict the policy statement to allow access only on behalf of the AWS account ID that hosts SES for you, like so:

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "ses.amazonaws.com"
            },
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::my-bucket-name/*",
            "Condition": {
                "StringEquals": {
                    "aws:SourceAccount": "123456789012"
                }
            }
        }
    ]
}
```

Leo K · Answer

I just compared what you described to a working production deployment in my environment, and it's set up identically to what you're describing, except for having a bunch of additional security restrictions, which only make my configuration more restrictive. It's been working for years.

To be sure, you also haven't configured sender IP address filters under Email receiving in SES? And you aren't receiving a non-delivery notification from or to Gmail when sending a test message from there? The email just doesn't arrive but also doesn't bounce?

Leo K · Answer

Okay, clear. @ in that context stands for an "apex record" for your DNS zone, as you're describing. Is your S3 bucket set to use SSE-S3 default encryption?

Leo K · Answer

Everything needed would appear to be in place then. Would you still double-check that in SES's email reception configuration, you only have one rule set, the rule set is in "active" status, and the receipt rule it contains shows as "enabled"?

Leo K · Answer

What you've described covers everything that is needed. You've validated your domain name, you have the right MX record, the S3 bucket is in the same region as your SES installation, the S3 bucket policy is permissive enough, the correct email receive rule set is set to active, and the rule set contains one rule, with one recipient, and it's set to deliver the messages in your S3 bucket.

What exactly was contained in the AMAZON_SES_SETUP_NOTIFICATION object appearing in the bucket?

What exactly was contained in the `AMAZON_SES_SETUP_NOTIFICATION` object appearing in the bucket?

S3 not saving emails from SES

Add your answer

Relevant content