How to Monitor AWS SES Identity Status with Real-Time Alerts
Arokya
Monitoring is a key part of any application. Whether it goes down or recovers, we need to be notified. Specifically, for applications hosted in AWS that send emails through AWS-managed services like AWS SES, there are many applications and notifications relying on it.
However, if any of the verified domains or email identities are removed or modified without your knowledge, will it affect your application sending emails through SES?
The answer is YES.
AWS SES continuously checks the verification status of identities based on the backend DNS configuration. If any required DNS record is removed or altered, AWS SES detects the change and updates the domain identity status to unverified. As a result, all applications using that particular domain identity will fail to send emails.
You might ask, “If emails fail, I will get bounce or failure alerts anyway, so why do I need additional monitoring or alert configuration?”
The reason is that a proactive approach is always better. Before end users or customers identify the issue, we should already know the status of our domain. If it fails, we need to receive an alert so that we can identify and resolve the issue before it is reported.
We can implement this as a fully cloud-native solution without relying on any third-party tools. This monitoring helps us receive alerts for both failures and recoveries in near real time.
Let me quickly go through the proposed solution so that you can use it in your environment as well.
We have scheduled an EventBridge rule every 15 minutes (you can reduce it to 1 minute if near-real-time monitoring is required). This triggers a Lambda function in the backend with a Python script.
The Lambda function first checks the current status of the AWS SES domain and email identities. During the first run, it stores the current state in Amazon DynamoDB. It checks whether a previous record exists or not. If no record exists, it stores the identity attributes and values, such as the domain or email name and status (last known verification state, like Success or Failed).
Optionally, if the domain or email identity contains owner information (email ID available in tags), it will add an attribute to DynamoDB for the domain owner’s email.
In subsequent runs, if the record already exists in DynamoDB, the Lambda function updates the current state. In every run, it compares the current status with the previous state stored in DynamoDB.
Based on the comparison:
If the status changes from Success to Failed/Pending, you will get a verification lost alert
If the status changes from Failed/Pending to Success, you will get a verification recovered alert
If both statuses are the same (for example, Pending to Pending or Success to Success), no alert will be triggered
This ensures that you receive only one alert for failure and one for recovery, avoiding multiple email triggers and reducing noise.
The main benefit of this solution is that it is fully AWS cloud-native. Since there is no direct native monitoring mechanism for AWS SES domain and email identity status, this approach helps you achieve near real-time alerting without using any third-party applications.
