Contents of notifications for Amazon SES email receiving

All notifications for email receiving are published to Amazon Simple Notification Service (Amazon SNS) topics in JavaScript Object Notation (JSON) format.

For example notifications, see Notification examples.

Contents

• Top-level JSON object
• receipt object
  • action object
  • dkimVerdict object
  • dmarcVerdict object
  • spamVerdict object
  • spfVerdict object
  • virusVerdict object
• mail object
  • commonHeaders object

Top-level JSON object

The top-level JSON object contains the following fields.

Field Name	Description
notificationType	The notification type. For this type of notification, the value is always Received.
receipt	Object that contains information about the email delivery.
mail	Object that contains information about the email associated with the notification.
content	String that contains the raw, unmodified email, which is typically in Multipurpose Internet Mail Extensions (MIME) format. For more information about MIME format, see RFC 2045. Note This field is present only if the notification was triggered by an SNS action. Notifications triggered by all other actions do not contain this field.

receipt object

The receipt object has the following fields.

Field Name	Description
action	Object that encapsulates information about the action that was executed. For a list of possible values, see action object.
dkimVerdict	Object that indicates whether the DomainKeys Identified Mail (DKIM) check passed. For a list of possible values, see dkimVerdict object.
dmarcPolicy	Indicates the Domain-based Message Authentication, Reporting & Conformance (DMARC) settings for the sending domain. This field only appears if the message fails DMARC authentication. Possible values for this field are: none: The owner of the sending domain requests that no specific action be taken on messages that fail DMARC authentication. quarantine: The owner of the sending domain requests that messages that fail DMARC authentication be treated by receivers as suspicious. reject: The owner of the sending domain requests that messages that fail DMARC authentication be rejected.
dmarcVerdict	Object that indicates whether the Domain-based Message Authentication, Reporting & Conformance (DMARC) check passed. For a list of possible values, see dmarcVerdict object.
processingTimeMillis	String that specifies the period, in milliseconds, from the time Amazon SES received the message to the time it triggered the action.
recipients	The recipients (specifically, the envelope RCPT TO addresses) that were matched by the active receipt rule. The addresses listed here may differ from those listed by the destination field in the mail object.
spamVerdict	Object that indicates whether the message is spam. For a list of possible values, see spamVerdict object.
spfVerdict	Object that indicates whether the Sender Policy Framework (SPF) check passed. For a list of possible values, see spfVerdict object.
timestamp	String that specifies the qualified date and time at which the action was triggered, in ISO 8601 format.
virusVerdict	Object that indicates whether the message contains a virus. For a list of possible values, see virusVerdict object.

action object

The action object has the following fields.

Field Name	Description
type	String that indicates the type of action that was executed. Possible values are S3, SNS, Bounce, Lambda, Stop, and WorkMail.
topicArn	String that contains the Amazon Resource Name (ARN) of the Amazon SNS topic to which the notification was published.
bucketName	String that contains the name of the Amazon S3 bucket to which the message was published. Present only for the S3 action type.
objectKey	String that contains a name that uniquely identifies the email in the Amazon S3 bucket. This is the same as the messageId in the mail object. Present only for the S3 action type.
smtpReplyCode	String that contains the SMTP reply code, as defined by RFC 5321. Present only for the bounce action type.
statusCode	String that contains the SMTP enhanced status code, as defined by RFC 3463. Present only for the bounce action type.
message	String that contains the human-readable text to include in the bounce message. Present only for the bounce action type.
sender	String that contains the email address of the sender of the email that bounced. This is the address from which the bounce message was sent. Present only for the bounce action type.
functionArn	String that contains the ARN of the Lambda function that was triggered. Present only for the Lambda action type.
invocationType	String that contains the invocation type of the Lambda function. Possible values are RequestResponse and Event. Present only for the Lambda action type.
organizationArn	String that contains the ARN of the Amazon WorkMail organization. Present only for the WorkMail action type.

dkimVerdict object

The dkimVerdict object has the following fields.

Field Name

Description

status

String that contains the DKIM verdict. Possible values are: PASS: The message passed DKIM authentication. FAIL: The message failed DKIM authentication. GRAY: The message is not DKIM-signed or the from domain and DKIM-signature domain do not match. PROCESSING_FAILED: There is an issue that prevents Amazon SES from checking the DKIM signature. For example, DNS queries are failing or the DKIM signature header is not formatted properly.

dmarcVerdict object

The dmarcVerdict object has the following fields.

Field Name	Description
status	String that contains the DMARC verdict. Possible values are: PASS: The message passed DMARC authentication. FAIL: The message failed DMARC authentication. GRAY: At least one of SPF or DKIM passed authentication, but the sending domain does not have a DMARC policy or uses the p=none policy. PROCESSING_FAILED: There is an issue that prevents Amazon SES from providing a DMARC verdict.

spamVerdict object

The spamVerdict object has the following fields.

Field Name

Description

status

String that contains the result of spam scanning. Possible values are: PASS: The spam scan determined that the message is unlikely to contain spam. FAIL: The spam scan determined that the message is likely to contain spam. GRAY: Amazon SES scanned the email but could not determine with confidence whether it is spam. PROCESSING_FAILED: Amazon SES was unable to scan the email. For example, the email is not a valid MIME message.

spfVerdict object

The spfVerdict object has the following fields.

Field Name	Description
status	String that contains the SPF verdict. Possible values are: PASS: The message passed SPF authentication. FAIL: The message failed SPF authentication. GRAY: The SPF result is none, softfail, or neutral. PROCESSING_FAILED: There is an issue that prevents Amazon SES from checking the SPF record. For example, DNS queries are failing.

virusVerdict object

The virusVerdict object has the following fields.

Field Name	Description
status	String that contains the result of virus scanning. Possible values are: PASS: The message does not contain a virus. FAIL: The message contains a virus. GRAY: Amazon SES scanned the email but could not determine with confidence whether it contains a virus. PROCESSING_FAILED: Amazon SES is unable to scan the content of the email. For example, the email is not a valid MIME message.

mail object

The mail object has the following fields.

Field Name	Description
destination	A complete list of all recipient addresses (including To: and CC: recipients) from the MIME headers of the incoming email.
messageId	String that contains the unique ID assigned to the email by Amazon SES. If the email was delivered to Amazon S3, the message ID is also the Amazon S3 object key that was used to write the message to your Amazon S3 bucket.
source	String that contains the email address (specifically, the envelope MAIL FROM address) that the email was sent from.
timestamp	String that contains the time at which the email was received, in ISO8601 format.
headers	The Amazon SES headers and your custom headers. Each header has the following fields: name and value.
commonHeaders	The headers common to all emails. Each header has the following fields: name and value.
headersTruncated	Specifies whether the headers were truncated in the notification, which happens if the headers are larger than 10 KB. Possible values are true and false.

commonHeaders object

The commonHeaders object can have the fields shown in the following table. The fields present in this object vary depending on which fields were present in the incoming email.

Field Name	Description
messageId	The ID of the original message.
date	The date and time when Amazon SES received the message.
to	The To header of the email.
cc	The CC header of the email.
bcc	The BCC header of the email.
from	The From header of the email.
sender	The Sender header of the email.
returnPath	The Return-Path header of the email.
replyTo	The Reply-To header of the email.
subject	The Subject header of the email.