Most websites send lead notifications through Amazon SES. It's cheap and reliable until a bot finds your form. Bots submit thousands of fake or stolen email addresses. If your form emails the person who submitted it ("Thanks for contacting us!"), every fake address becomes a bounce, and every real but unwilling recipient becomes a spam complaint.
AWS watches both numbers closely. Cross the line and SES first puts your account under review, then pauses sending for the whole AWS account. That means lead notifications, password resets, invoices and order confirmations all stop at once.
The worst part: nothing on your website looks broken. The form still says "Thank you." You just stop getting leads, and you find out days later.
The thresholds AWS uses
| Metric | Under review | Sending can be paused |
|---|---|---|
| Bounce rate | 5% | 10% |
| Complaint rate | 0.1% | 0.5% |
A single night of form-bombing can push a small account past these numbers.
6 ways to find out SES has been paused1. Your own application logs (fastest, if you don't swallow errors)
Once sending is paused, every SES API or SMTP call is rejected with a "sending paused" error. Many websites wrap the email call in a try/catch and carry on silently. Instead:
- Save the lead to your database before sending the email, so a failed email never means a lost lead.
- Log every failed send, and alert on it through a channel that doesn't use SES, such as WhatsApp, SMS or Slack.
2. The email AWS sends you
AWS emails the address on your AWS account when your account goes under review and again when sending is paused. The problem is that this is often an old founder inbox or a shared account nobody reads. Make sure the account's email, and the Operations alternate contact, go to someone who acts on them.
3. The SES console
The SES Account dashboard shows your status as Healthy or Paused. The Reputation metrics page shows your bounce and complaint rates, plus statuses like Under review and Pending sending pause. It's useful, but only if someone looks.
4. AWS Health Dashboard + EventBridge
When AWS pauses sending, it adds an "SES sending paused" event to your AWS Health Dashboard. Better still, create an EventBridge rule that matches AWS Health events for SES and sends them to SNS. From there, forward them to SMS, email or a webhook for WhatsApp/Slack:
{
"source": ["aws.health"],
"detail": { "service": ["SES"] }
}5. CloudWatch alarms, before the pause happens
SES publishes Reputation.BounceRate and Reputation.ComplaintRate to CloudWatch (namespace AWS/SES). Set alarms well below the AWS thresholds, for example 2% bounce and 0.05% complaint. Then you get warned while the attack is happening, not after the damage is done.
6. A scheduled status check
A small cron job that asks SES whether sending is enabled. It catches a pause no matter what caused it:
#!/bin/bash
# Run every 15 minutes from cron
REGION="ap-south-1"
ENABLED=$(aws sesv2 get-account --region "$REGION" --query 'SendingEnabled' --output text)
STATUS=$(aws sesv2 get-account --region "$REGION" --query 'EnforcementStatus' --output text)
if [ "$ENABLED" != "True" ] || [ "$STATUS" != "HEALTHY" ]; then
# Alert through something that is NOT SES: SMS, WhatsApp API, Slack webhook
aws sns publish --region "$REGION" --topic-arn "arn:aws:sns:$REGION:123456789012:ops-alerts" \
--message "SES problem: SendingEnabled=$ENABLED, Status=$STATUS"
fi- Don't email the address typed into the form. Send the notification to your own team only. This one change removes most of the bounce and complaint risk.
- Add a bot check (Cloudflare Turnstile, reCAPTCHA) and a hidden honeypot field.
- Rate-limit submissions per IP and per email address.
- Handle bounces and complaints: turn on the SES account-level suppression list, and send bounce and complaint notifications to SNS.
- Separate risky email into its own configuration set, or even its own AWS account, so a problem with marketing or form email can't stop your transactional email.
Want this set up for you?
We set up SES monitoring with WhatsApp, SMS and email alerts, protect forms from bots, and set up bounce handling so a bot attack doesn't take down your email. Write to us at hello@bluecurrentlabs.com.