Menu
Amazon Simple Email Service
Developer Guide

Contents of Notifications for Amazon SES Email Receiving

All notifications for email receiving are published to Amazon Simple Notification Service (Amazon SNS) topics in JavaScript Object Notation (JSON) format.

Top-Level JSON Object

The top-level JSON object contains the following fields.

Field Name Description

notificationType

String that specifies the notification type. This value will always be Received.

receipt

Object that contains information about the email delivery.

mail

Object that contains information about the email to which the notification pertains.

content

String that contains the raw, unmodified email, which is typically in Multipurpose Internet Mail Extensions (MIME) format. For more information about MIME format, see RFC 2045.

Note

This field is present only if the notification was triggered by an SNS action. Notifications triggered by all other actions do not contain this field.

receipt Object

The receipt object has the following fields.

Field Name Description

action

Object that encapsulates information about the action that was executed. For a list of possible values, see action Object.

dkimVerdict

Object that indicates whether the DomainKeys Identified Mail (DKIM) check passed. For a list of possible values, see dkimVerdict Object.

dmarcPolicy Object that indicates the Domain-based Message Authentication, Reporting & Conformance (DMARC) settings for the sending domain. This field only appears if the value of dmarcVerdict is FAIL. For a list of possible values, see dmarcPolicy Object.
dmarcVerdict Object that indicates whether the Domain-based Message Authentication, Reporting & Conformance (DMARC) check passed. For a list of possible values, see dmarcVerdict Object.

processingTimeMillis

String that specifies the period, in milliseconds, from the time Amazon SES received the message to the time it triggered the action.

recipients

A list of the recipient addresses for this delivery. This list might be a subset of the recipients to which the mail was addressed.

spamVerdict

Object that indicates whether the message is spam. For a list of possible values, see spamVerdict Object.

spfVerdict

Object that indicates whether the Sender Policy Framework (SPF) check passed. For a list of possible values, see spfVerdict Object.

timestamp

String that specifies the date and time at which the action was triggered, in ISO 8601 format.

virusVerdict

Object that indicates whether the message contains a virus. For a list of possible values, see virusVerdict Object.

action Object

The action object has the following fields.

Field Name Description

type

String that indicates the type of action that was executed. Possible values are S3, SNS, Bounce, Lambda, Stop, and WorkMail.

topicArn

String that contains the Amazon Resource Name (ARN) of the Amazon SNS topic to which the notification was published.

bucketName

String that contains the name of the Amazon S3 bucket to which the message was published. Present only for the S3 action type.

objectKey

String that contains a name that uniquely identifies the email in the Amazon S3 bucket. This is the same as the messageId in the mail object. Present only for the S3 action type.

smtpReplyCode

String that contains the SMTP reply code, as defined by RFC 5321. Present only for the bounce action type.

statusCode

String that contains the SMTP enhanced status code, as defined by RFC 3463. Present only for the bounce action type.

message

String that contains the human-readable text to include in the bounce message. Present only for the bounce action type.

sender

String that contains the email address of the sender of the email that bounced. This is the address from which the bounce message was sent. Present only for the bounce action type.

functionArn

String that contains the ARN of the Lambda function that was triggered. Present only for the Lambda action type.

invocationType

String that contains the invocation type of the Lambda function. Possible values are RequestResponse and Event. Present only for the Lambda action type.

organizationArn

String that contains the ARN of the Amazon WorkMail organization. Present only for the WorkMail action type.

dkimVerdict Object

The dkimVerdict object has the following fields.

Field Name Description

status

String that contains the DKIM verdict. Possible values are as follows:

  • PASS – The check succeeded.

  • FAIL – The check failed.

  • GRAY – The message is not DKIM-signed.

  • PROCESSING_FAILED – There is an issue that prevents Amazon SES from checking the DKIM signature. For example, DNS queries are failing or the DKIM signature header is not formatted properly.

dmarcPolicy Object

The dmarcPolicy object has the following fields.

Field Name Description

status

String that contains additional information about sending domains for emails that fail DMARC authentication. Possible values are as follows:

  • NONE – The owner of the sending domain requests that no specific action be taken on messages that fail DMARC authentication.

  • QUARANTINE – The owner of the sending domain requests that messages that fail DMARC authentication be treated by receivers as suspicious.

  • REJECT – The owner of the sending domain requests that messages that fail DMARC authentication be rejected.

dmarcVerdict Object

The dmarcVerdict object has the following fields.

Field Name Description

status

String that contains the DMARC verdict. Possible values are as follows:

  • PASS – The message passed DMARC authentication.

  • FAIL – The message failed DMARC authentication.

  • GRAY – The message failed DMARC authentication, and the sending domain does not have a DMARC policy, or uses the p=none policy.

  • PROCESSING_FAILED – There is an issue that prevents Amazon SES from providing a DMARC verdict.

spamVerdict Object

The spamVerdict object has the following fields.

Field Name Description

status

String that contains the result of spam scanning. Possible values are as follows:

  • PASS – The check succeeded.

  • FAIL – The check failed.

  • GRAY – Amazon SES scanned the email but could not determine with confidence whether it is spam.

  • PROCESSING_FAILED – Amazon SES is unable to scan the content of the email. For example, the email is not a valid MIME message.

spfVerdict Object

The spfVerdict object has the following fields.

Field Name Description

status

String that contains the SPF verdict. Possible values are as follows:

  • PASS – The check succeeded.

  • FAIL – The check failed.

  • GRAY – There is no SPF policy under the domain used in the MAIL FROM command.

  • PROCESSING_FAILED – There is an issue that prevents Amazon SES from checking the SPF record. For example, DNS queries are failing.

virusVerdict Object

The virusVerdict object has the following fields.

Field Name Description

status

String that contains the result of virus scanning. Possible values are as follows:

  • PASS – The check succeeded.

  • FAIL – The check failed.

  • GRAY – Amazon SES scanned the email but could not determine with confidence whether it contains a virus.

  • PROCESSING_FAILED – Amazon SES is unable to scan the content of the email. For example, the email is not a valid MIME message.

mail Object

The mail object has the following fields.

Field Name Description

destination

A list of email addresses that are recipients of the email.

messageId

String that contains the unique ID assigned to the email by Amazon SES. If the email was delivered to Amazon S3, the message ID is also the Amazon S3 object key that was used to write the message to your Amazon S3 bucket.

source

String that contains the email address from which the email was sent (the envelope MAIL FROM address).

timestamp

String that contains the time at which the email was received, in ISO8601 format.

headers

A list of Amazon SES headers and your custom headers. Each header in the list has a name field and a value field.

commonHeaders

A list of headers common to all emails. Each header in the list is composed of a name and a value.

headersTruncated

String that specifies whether the headers were truncated in the notification, which will happen if the headers are larger than 10 KB. Possible values are true and false.