Conundrum on SMTP via SES

Question

I have a VPN setup, tunnels working, I can see the on-prem device connection to the SES endpoint I setup:

2024-07-22T15:52:03.000-07:00	2 632257070288 eni-06361c95e21cc9acd 172.20.104.4 172.31.1.13 49172 587 6 20 2043 1721688723 1721688783 ACCEPT OK

What does not happen however is an email being sent to the email address as expected. The Security group has inbound for
IPv4	All traffic	All	All	172.20.104.0/24
IPv4        SMTP	        TCP	25	172.31.0.0/24
Custom   TCP	                TCP	587	172.31.0.0/24

I don't think the SG is the issue. What else should I look at to try and figure out why SES is not seeing an Email to send, but I can see a connection?

Mohammed sayeeduddin · Answer

Hi, Have you done proper ses configuration like domain verification, sender id verification and got production approval(not sandbox)

Enable to cloudwatch then share the log details

Thanks

Mav · Answer

2024-07-23T04:58:18.000-07:00	2 632257070288 eni-06361c95e21cc9acd 172.20.104.4 172.31.1.13 49180 587 6 25 2295 1721735898 1721735958 ACCEPT OK
2024-07-23T04:58:18.000-07:00	2 632257070288 eni-06361c95e21cc9acd 172.31.1.13 172.20.104.4 587 49180 6 29 7915 1721735898 1721735958 ACCEPT OK

So, communication both ways; no email received and the only thing I see in the SNS topic feeding the dashboard is

{
    "notification": {
        "messageMD5Sum": "5bb5f6b19bb3c4e085b6e3048361737b",
        "messageId": "32110e91-0b9d-5e6f-a82a-518895320e9f",
        "topicArn": "arn:aws:sns:us-west-1:632257070288:SES_Metrics",
        "timestamp": "2024-07-23 12:05:03.6"
    },
    "delivery": {
        "deliveryId": "b07ddb1c-4c0e-5f60-ad57-8405d2a1a2ae",
        "destination": "http://54.219.98.72/webhook/brX64Qw4sh4oOYfeMmy9kLcT5vKFcgWQZxphx_ixmwpbtYBZKMA589ifHi241tHvhG-05T0OVNTKsQLhLNvAfQ",
        "providerResponse": "Bad Request",
        "dwellTimeMs": 39,
        "statusCode": 400
    },
    "status": "SUCCESS"
}

No idea why it's a bad request. Let me think about how to see what is being sent to SNS that is giving the Bad Request.

Yaniv Rozenboim · Answer

Can you change your security group to allow ALL traffic (0.0.0.0/0 all ports all protocols) just to test and verify if the SG is indeed not the root cause here.

(I see for example some of your rules relate to 172.31.0.0/24 but the IP I see in the VPC flow log you shared is 172.31.1.13 which is not in that range)

Mav · Answer

I am baffled by this
![Connection](/media/postImages/original/IM5CHmqs4fS2uoOnyYRGScNA)

2024-07-25T11:37:05.000-07:00
2 632257070288 eni-06361c95e21cc9acd 172.20.104.4 172.31.1.13 49205 587 6 25 2295 1721932625 1721932685 ACCEPT OK

tgw-attach-025bd083a6c4c4538 172.20.104.4 172.31.1.13 49205 587 6 25 2295 1721932625 1721932632 OK IPv4 0 0 0 0 27 us-west-1 egress - -

2024-07-25T11:37:18.000-07:00
2 632257070288 eni-06361c95e21cc9acd 172.31.1.13 172.20.104.4 587 49205 6 5 327 1721932638 1721932698 ACCEPT OK

tgw-attach-025bd083a6c4c4538 172.31.1.13 172.20.104.4 587 49205 6 29 7915 1721932625 1721932632 OK IPv4 0 0 0 0 27 us-west-1 ingress - -

There is clearly a connection happening and data being sent to the SMTP service, but an email is never actually sent out. I don't ever get an SNS message for it, an email in my email inbox, and I have no idea how else to track down the issue.

Conundrum on SMTP via SES

Relevant content