AWS Non-Verified Account How to fix AWS SES SMTP authentication error in your application

AWS Account / 2026-09-02 16:19:04

How to fix AWS SES SMTP authentication error in your application (with the account/payment/KYC reality check)

If your application throws an “SMTP authentication failed”, “535 5.7.8 Username and Password not accepted”, or “Authentication required” error when sending via AWS SES, you usually don’t have a “coding problem” first—you have a mismatch between:

which SES credentials you’re using (SMTP vs API vs “IAM user”)
the region/endpoint you’re connecting to
your SES sending authorization status (production access, sandbox limits)
your AWS account risk/compliance posture (payment verification, restrictions, fraud controls)
how your app is authenticating (TLS requirements, port, STARTTLS vs implicit TLS)

This guide is written for the exact situation where you already bought/created an AWS account (or are in the process), you’re trying to wire SES into an app, and the SMTP auth error blocks sending.

First: identify the exact error code (it changes the fix)

Before you change anything, capture the full SMTP transcript and error text. A few variations below correspond to different causes:

Error text (common)	Most likely cause	Fast checks
`535 5.7.8 Username and Password not accepted`	Wrong SMTP credentials (not the SMTP username/password you think)	Confirm SMTP credentials under the correct SES/region and don’t confuse with IAM access keys
`534 5.7.9 Application-specific password required`	You’re using an auth method not allowed for SES SMTP	Use SES SMTP credentials created for SMTP sending
`530 5.7.0 Authentication required` or immediate AUTH failure	Port/TLS mismatch or your app isn’t actually negotiating TLS before AUTH	Verify STARTTLS flow and correct port (usually 587) and endpoint
`454 4.7.1 Relay access denied`	Sending configuration mismatch (identity not verified / destination blocked / region mismatch)	Check verified identity and sandbox constraints
It “authenticates” but mails bounce with “Message rejected”	Not an auth issue—sandbox/production identity verification or sending limits	Check SES sending status, domain verification, and account throttles

Most common root causes (and the exact operational fixes)

1) You’re using IAM access keys as SMTP credentials (this is the #1 real-world mistake)

In many applications, developers generate Access Key ID / Secret Access Key and attempt to use them directly in SMTP AUTH. SES SMTP doesn’t accept AWS API signing credentials.

Correct approach: create SMTP credentials in SES (or use the SMTP credentials generated by AWS Console), then use that SMTP username and SMTP password in your app.
Operational check: verify you didn’t accidentally paste the IAM access key into the SMTP username field.

AWS Non-Verified Account Fast fix: In AWS Console, open SES in the same region you configured your SMTP endpoint. Look for SMTP settings/credentials and confirm the username/password pair being used by your application.

2) Region mismatch: connecting to the wrong SES SMTP endpoint

SES SMTP credentials and sending endpoints are tied to the SES region. If your app points to email-smtp.us-east-1.amazonaws.com but your SMTP credentials were created in eu-west-1, authentication can fail or sending can be rejected depending on configuration.

Fix: align three things: SES region, SMTP endpoint, and credentials location.
How to avoid this later: store region+endpoint+credentials mapping in config and deploy it as an atomic set.

AWS Non-Verified Account Actionable test: use a local SMTP test tool (or a short script) against your chosen endpoint with the same username/password. If it fails locally but works in dev, it’s usually config/environment mismatch (not SES itself).

3) TLS/port/auth negotiation mismatch (your app might skip STARTTLS)

SES SMTP commonly expects proper TLS negotiation. Many “works in dev” issues happen because local testing used one port while production uses another, or the SMTP client library behaves differently.

If you use port 587: ensure your client uses STARTTLS before AUTH.
If you use port 465: ensure it’s implicit TLS (not STARTTLS).
Fix: explicitly set TLS mode in your SMTP library config and log the connection settings.

Practical check: enable SMTP client debug logs in your application environment (not just code). Confirm the order: connection → STARTTLS/handshake → AUTH → SMTP AUTH response.

4) Wrong “From” identity/verified address doesn’t always show up as an auth error—but it blocks sending

Sometimes what looks like an authentication failure is actually a later acceptance or relay denial, especially if your app’s logs merge events. SES may reject sending if:

the From domain or email address isn’t verified
your account is still in sandbox mode with limited recipients
you’re trying to send to non-allowed recipients
you hit an SES sending restriction/throttling pattern

Fix path:

Verify the domain (recommended) in SES.
If you need wide sending, request production access (production send quota approval).
Confirm the destination addresses are allowed if you’re still in sandbox.

5) AWS account risk control: payment/KYC not fully settled (can trigger SES restrictions)

This part surprises many teams: an SES SMTP “authentication” error can be a symptom of broader account risk posture—especially if you’re provisioning quickly after purchasing an account, or if payments/KYC were partially completed.

In my operational experience assisting teams with AWS setups (including international accounts), the strongest correlation is:

Account funding method → settlement state (some methods leave the account in a “pending review/limited ability” state).
KYC verification level (if the identity verification is incomplete or mismatched, you can see service restrictions and intermittent messaging failures).
Risk control triggered by unusual sending patterns (new accounts trying to send a lot with low verification maturity).

What to do:

Check AWS Billing & Cost Management: confirm the payment method is active and there are no “pending” statuses.
Check AWS Account/Identity: confirm KYC is fully completed (not just submitted).
Check service limits: SES quotas and any account-level restrictions/alerts in the Console.

Practical remediation strategy: before debugging deep SMTP, verify your AWS account is fully enabled for SES sending and that there are no billing/KYC blocks. Otherwise, you’ll waste hours on app-level credential changes that won’t fix restricted service behavior.

Account purchasing reality: how sellers’ setups lead to SES SMTP errors

If you’re starting from a “purchased AWS account” (or an account obtained via a reseller/transfer), SES issues can be more common. Reasons include:

Region/tenancy configurations differ from the seller’s assumption, so your endpoint+credential mapping is wrong.
KYC details mismatch (seller used one identity, you operate with a different entity). Risk systems can throttle or restrict.
Payment instrument not fully verified (account may be “working” for some services but restricted for outbound messaging).
Prior suspicious activity on the account (risk controls carry over).

If you’re evaluating whether to use a purchased account for SES, the operational question is: can you complete/confirm KYC and payment verification yourself without waiting?

What I recommend: use an account where you can complete KYC and billing setup under your own business details. SES sending is highly sensitive to compliance and risk posture—billing and identity are not “nice to have.”

Identity verification (KYC) and compliance reviews: what matters for SES problems

Users often search “AWS SES SMTP auth error KYC” because they noticed correlation with verification steps. Here’s what tends to matter in practice:

KYC submission vs approval: If verification is still pending, you may see service limitations.
Entity consistency: if your billing account and sending identity (domains/addresses) are inconsistent with business intent, risk systems may intervene.
AWS Non-Verified Account Sending behavior: new account, high volume, and low verification maturity can trigger risk controls.

Actionable checklist before retrying SMTP auth:

Confirm SES region alignment.
Confirm SMTP credentials are correct (not IAM keys).
Confirm the sending identity (domain/email) is verified.
Confirm your AWS account billing method is fully active (no pending verification).
Confirm any SES sending permissions/quota are available for your account status.

Payment methods and funding/renewals: what changes when SES starts failing

Even though SMTP authentication is “credentials-level,” real operational failures often coincide with payment state issues. Different payment methods can have different settlement behaviors and verification triggers.

Common scenarios I’ve seen:

Cards with delayed settlement / 3DS challenges: account may appear usable, but some outbound services can behave inconsistently if billing status isn’t fully healthy.
New payment method added: after adding a method, there can be a brief risk check period where certain actions are limited.
AWS Non-Verified Account Top-up/renewal timing: for some organizations using specific billing mechanisms, there’s a window where quotas and service availability can change.

What to check in AWS:

Billing dashboard for any unpaid/failed billing attempts.
Notifications about account verification or risk review.
SES quota availability (not just whether the console loads).

Decision rule: if your SES SMTP auth started failing right after a payment method change or renewal event, prioritize billing/verification checks before rewriting your SMTP code.

Cost comparison: SMTP vs API and where auth errors waste money

When debugging SES, teams often switch from SMTP to API (or vice versa). Here’s the practical cost lens:

Option	What tends to fail first	Cost impact during debugging	When I recommend it
SES SMTP	TLS/auth/credential mismatch	Usually low per attempt, but repeated failures can trigger risk throttles or account scrutiny if spam-like patterns occur	You already have an SMTP stack and can stabilize config quickly
SES API (SendEmail/SendRawEmail)	IAM permissions, region, identity verification	Retries are more controlled and observable; you can fail fast with fewer “mystery” SMTP client behaviors	You want deterministic behavior and better logging

Budget-safe approach: if SES SMTP auth fails repeatedly, pause sending attempts and fix credentials/region/TLS first. Otherwise, you can burn through your time and trigger account risk controls that complicate both SMTP and API.

Troubleshooting playbook (do this in order, with real decision points)

AWS Non-Verified Account Step 1: Confirm you’re using SES SMTP credentials (not IAM keys)

In your application config, verify which fields map to SMTP username and password.
Compare them to the SES SMTP credential source in the AWS console.

Step 2: Validate endpoint and region

Log the endpoint hostname, port, and region in your application startup logs.
Make sure the endpoint matches the region where credentials exist.

Step 3: Verify TLS behavior in your SMTP library

Check whether the library uses STARTTLS on 587.
Confirm implicit TLS on 465 if used.
Turn on debug logs to verify handshake order.

Step 4: Verify SES identity + sandbox/production sending limits

Confirm domain/email identity verification in SES.
If sandbox: ensure recipients are allowed.
If production required: submit production access request and wait for approval.

Step 5: Check AWS account billing/KYC status when errors persist

Review billing dashboard for failed payments or pending verification.
Check account verification/KYC status and any risk review notifications.
If you’re on a purchased/transferred account: expect risk controls and confirm you can fully manage billing verification under your own identity.

FAQ: SES SMTP authentication error, AWS accounts, and operational blockers

Q1: “I fixed the username/password, but SES still says auth failed.” What else is likely?

Most often it’s region mismatch (endpoint doesn’t match credential region) or TLS mismatch (AUTH attempted before STARTTLS). Second, verify you’re using the SES SMTP credential pair—not an IAM access key.

AWS Non-Verified Account Q2: “Do I need to complete KYC to use SES SMTP?”

In many setups, SES console can be accessible without fully settled KYC immediately, but sending capability and risk controls can still be restricted until verification is fully approved. If you see errors that started after account changes (billing method, identity update, new account activation), check KYC and billing status first.

Q3: “What payment method should I use to avoid AWS SES issues?”

From an operational standpoint, choose a method that can be verified quickly and reliably in your region. Cards with frequent 3DS/verification delays sometimes correlate with “pending review” states. The key isn’t the brand; it’s whether your AWS billing status is stable and fully active.

AWS Non-Verified Account Q4: “My app logs show SMTP auth failing, but the AWS console says verified identities exist.”

That points back to client-side issues: SMTP credential mismatch, endpoint/region mismatch, or TLS/port behavior. Verified identity affects acceptance/sending, but a clear “Username and Password not accepted” is usually credential/endpoint/TLS.

Q5: “I’m using a purchased AWS account. Could that cause SES auth errors?”

Yes. Purchased or transferred accounts often carry risk control history or incomplete/locked-in billing/KYC setup. Even if basic services work, SES sending is more sensitive to compliance posture. If you can’t directly confirm billing verification and KYC completion under your own entity, you’ll likely keep hitting unpredictable restrictions.

Q6: “Is there a way to test SMTP auth without spamming recipients?”

Yes—use a minimal SMTP test to an allowed recipient (or the smallest permitted test recipient set). The goal is to validate credential/TLS/endpoint behavior without triggering sandbox limitations repeatedly or creating suspicious retry patterns.

What to do if you’re planning to build a sending system now (not just fix an error)

If you’re actively implementing SES for production messaging, treat authentication fixes as part of an end-to-end readiness checklist:

Credential management: store SES SMTP credentials securely; rotate if you suspect exposure.
Region configuration: make region an explicit deploy parameter and keep endpoint/credentials consistent.
Verification readiness: verify domain and ensure production access status if you need wide sending.
Billing stability: prevent failed payment events and avoid frequent payment method changes during launch.
Risk-aware retries: implement exponential backoff and stop after a small number of auth failures to avoid triggering stricter controls.

If you want, paste the exact SMTP error text (including the SMTP response code) and your endpoint/port/TLS setting. I’ll tell you which branch of this playbook to follow and what to verify first.