Failed to save email settings: Email address is not verified

ks888 / LambStatus

[Maintenance mode] Serverless Status Page System

https://lambstatus.github.io

Apache License 2.0

1.3k stars 119 forks source link

Failed to save email settings: Email address is not verified #97

Closed chris-scentregroup closed 6 years ago

chris-scentregroup commented 6 years ago

Upon saving the setting, I receive:

Error: failed to send the test email. Email address is not verified. The following identities failed the check in region US-WEST-2: foo@bar.com

I understand the SES simulator is used, but I'm unsure how to replicate it.

If I send the mail using SES, it works fine, e.g.:

aws --region us-west-2 --profile prd ses send-email --from "foo@bar.com" --destination "ToAddresses=me@me.com" --message "Subject={Data=from ses,Charset=utf8},Body={Text={Data=ses says hi,Charset=utf8},Html={Data=hello,Charset=utf8}}"
{
    "MessageId": "01010161b06c7f94-f36c15a6-1e25-49b2-a48d-772fb35fe846-000000"
}

I have completed the domain verification and have the SES sandbox removed per the prereqs in https://lambstatus.github.io/set-up-email-notification.

Advice on how to diagnose/solve appreciated.

chris-scentregroup commented 6 years ago

Also tested sending to the simulator with above awscli command and "ToAddresses=success@simulator.amazonses.com" with no error back. It kind of feels as though an old error is cached or something..

chris-scentregroup commented 6 years ago

Have also just performed a stack update to see if this helps, but no bueno.

ks888 commented 6 years ago

I'm not sure why it happens... CloudWatch Logs saves detailed logs, so can you check the log? To see it, access the CloudWatch Logs page (the region should be same as the cloudformation stack) and choose the Log Groups /aws/lambda/[Your stack name]-PatchSettings.

Some random thoughts are:

The wrong SES region? AWS docs says the verification status is seprate for each region.
The AWS account of the verified domain may be different from the created stack. The case is not supported yet.
The request to move out of the sandbox is not processed yet. The last part of this doc shows ways to determine whether your account has been moved out of the sandbox.

chris-scentregroup commented 6 years ago

Thanks @ks888 I think it is likely the second point - the SES, DNS, DKIM etc. is in a different AWS account. Let me see if it is possible to move that.

ks888 commented 6 years ago

I see. DNS can be in the different account, but the SES verified domain must be in the same account.

chris-scentregroup commented 6 years ago

Ok, that was exactly it. Worked without a hitch now and managed to keep it all in infra code using https://github.com/skyscrapers/terraform-ses as a base. Thank you once again for your kind attention to service, @ks888 !