ESP Warmup

SES Sandbox to Production: Warmup Steps Before Scaling Volume

A technical guide on moving Amazon SES out of sandbox mode and executing a strategic IP and domain warmup to ensure high deliverability at scale.

7 min read7 sectionsGuide 16 of 30 in ESP Warmup
  • Amazon SES sandbox
  • SES production access
  • email warmup strategy
  • AWS SES deliverability
  • IP warming
  • sender reputation

Transitioning from the Amazon Simple Email Service (SES) sandbox to a production environment is a critical milestone for any application. By default, all new SES accounts are placed in a sandbox environment where you can only send to verified email addresses and domains. While this prevents accidental abuse during development, it also means your 'sender reputation' is non-existent. Moving to production requires more than just clicking a button in the AWS Console; it requires a calculated warmup strategy to ensure your emails actually reach the inbox.

Amazon SES is highly sensitive to bounce and complaint rates. If you scale too quickly without a warmup period, you risk temporary suspension or being placed on an internal AWS suppression list. Effective warmup involves gradually increasing your email volume over several days or weeks to prove to both AWS and mailbox providers like Gmail and Outlook that you are a legitimate sender.

Requesting Production Access the Right Way

The first step is submitting a service limit increase request through the AWS Support Center. AWS employees manually review these requests, so providing detailed context is essential. You should specify whether you intend to send marketing or transactional emails, how you collect subscriber addresses, and how you handle opt-outs.

Avoid vague descriptions. State clearly that you have a double opt-in process and that you use a bounce management system. AWS wants to see that you understand email etiquette and compliance. Once your request is approved, you will be granted a daily sending quota and a maximum send rate (messages per second). These numbers are your ceiling, but they should not be your starting point.

The Logic Behind Gradient Volume Increases

Mailbox providers use sophisticated algorithms to detect spam. A sudden spike of 50,000 emails from an IP or domain that previously sent zero is a primary indicator of a compromised server or a spammer. By warming up your account, you are establishing a 'normal' traffic pattern.

During this phase, you should prioritize your most engaged users. If you have historical data, send your first production batches to users who have opened or clicked an email in the last 30 days. High engagement signals to ISPs that your content is wanted, which builds the reputation necessary to support larger volumes later on. Monitoring tools like SenderSignal can be used during this phase to track your placement across different providers and ensure your reputation is trending upward.

A Sample 14-Day Warmup Schedule

While every sender's needs are different, a standard conservative warmup schedule often follows a doubling pattern. If your target is 50,000 emails per day, your schedule might look like this:

Day 1-2
Send 50-100 emails to internal addresses or highly engaged testers.
Day 3-4
Increase to 500 emails per day.
Day 5-6
Increase to 2,000 emails per day.
Day 7-8
Increase to 5,000 emails per day.
Day 9-10
Increase to 10,000 emails per day.
Day 11-12
Increase to 25,000 emails per day.
Day 13-14
Reach your full 50,000 volume.

If at any point your bounce rate exceeds 2% or your complaint rate exceeds 0.1%, stop the volume increase immediately. Maintain the current volume until the metrics stabilize, then resume the increase. This 'pause and stabilize' method is far safer than pushing through bad data.

Essential Technical Pre-Flight Checks

Before sending your first production email, your technical configuration must be flawless. AWS SES provides tools for this, but the responsibility for implementation lies with the user.

DKIM and SPF Authentication

DomainKeys Identified Mail (DKIM) and Sender Policy Framework (SPF) are non-negotiable. SES makes DKIM setup simple through Easy DKIM, which provides CNAME records for your DNS. Ensure these are verified in the SES console before sending. Without these, many ISPs will reject your mail outright during the warmup phase.

DMARC Implementation

Domain-based Message Authentication, Reporting, and Conformance (DMARC) tells receiving servers what to do if an email fails SPF or DKIM. Starting with a policy of p=none is fine for warmup, but it should be present. It adds a layer of professional identity to your domain.

Custom MAIL FROM Domain

By default, SES uses a subdomain of amazonses.com as the MAIL FROM address. Setting up a custom MAIL FROM domain (e.g., mail.yourdomain.com) ensures that your SPF alignment is 100% and helps you build your own domain reputation rather than relying solely on Amazon's.

Managing Bounces and Complaints

Amazon SES does not automatically remove bounced addresses from your list unless you configure the Virtual Deliverability Manager or use a dedicated suppression list. If you continue to send to addresses that have previously bounced, your reputation will plummet.

You must set up Amazon SNS (Simple Notification Service) topics to notify your application of 'Bounce' and 'Complaint' events. Your backend should automatically mark these users as 'unsubscribed' in your database. High bounce rates are the fastest way to get your SES account moved back into the sandbox or suspended entirely.

Monitoring Success During Scaling

As you increase volume, you need visibility beyond just 'delivered' or 'failed.' Deliverability is about whether the email reached the inbox or the junk folder. Using a monitoring platform like SenderSignal allows you to run seed tests during your warmup. This helps you identify if a specific provider, like Outlook, is throttling your messages while others are delivering them fine.

Check your AWS CloudWatch metrics daily. Specifically, watch the Send, Reject, Bounce, and Complaint metrics. If you see 'Rejects,' it means AWS has blocked your send because it would have exceeded your quota or because the email was on a suppression list. This is a sign to slow down your automation.

Maintaining Reputation Post-Warmup

Warmup is not a one-time event if your sending patterns are inconsistent. If you stop sending for more than 30 days, you may need to re-warm your IP or domain, as ISP algorithms have short memories.

Consistency is the key to long-term deliverability. Avoid 'bursty' sending patterns where you send 100,000 emails on the first of the month and nothing for the remaining 29 days. Instead, try to spread your volume out. Regular monitoring and staying proactive with list hygiene will ensure that your transition from the SES sandbox to a high-volume production environment remains successful and stays successful.

Frequently asked

Questions about this topic

How long does it take to move from SES sandbox to production?
AWS typically reviews production access requests within 24 hours, though approval is not guaranteed. Once approved, the actual warmup process to reach high volumes usually takes 2 to 4 weeks depending on your target daily limit.
What happens if I skip the warmup process on Amazon SES?
Skipping warmup often triggers AWS automated fraud and abuse systems, leading to immediate account pauses or lower sending quotas. Furthermore, mailbox providers like Gmail and Outlook may route your traffic to spam if they see a sudden surge from a cold AWS IP.
Can I use the same warmup strategy for shared and dedicated SES IPs?
While the principles are similar, dedicated IPs require a much more rigorous and gradual volume increase because you are the sole sender. Shared IPs have a baseline reputation, but your specific domain still needs to be 'introduced' to major ISPs slowly to build trust.

More on esp warmup

Related ESP Warmup guides that build on this one.

Related reading across SenderSignal

Guides from other disciplines that connect to this topic.

Start free in two minutes

See where your email actually lands.

Placement testing, blacklist monitoring and reputation tracking in one workspace.