# SES Identity Unverified / Unusable

> SES email identities stuck in a terminal verification state, either FAILED or NOT_STARTED, are dead configuration that can never send mail. ZopNight fires on exactly those 2 terminal states, abstains on transient PENDING and TEMPORARY_FAILURE (mid-onboarding identities AWS is still verifying), and remediates by calling sesv2 DeleteEmailIdentity.

Source: https://zop.dev/integrations/aws/recommendations/ses-identity-unverified-unusable
Updated: 2026-08-19

---

## Why verification status replaced send counts

the original v1 contract gated on a per-identity sends=0 signal, but that contract is physically un-honorable, because the only native SES activity metric, AWS/SES Send / Delivery (CloudWatch), is published at the
or per ses:configuration-set, never per email identity (see backend/aggregator/docs/METRICS.md §SES). Emitting a per-resource sends=0 from that metric would fabricate a measured-zero claim. The rule is re-keyed onto verification_status, a real signal harvested by the dedicated SESProvider (sesv2 ListEmailIdentities) and stamped onto resource.Metadata, with UID convention ses-identity/\<region>/\<name>. Only the terminal non-verified states fire (FAILED, NOT_STARTED): dead configuration to complete or delete. The transient states abstain (2026-07-05, third-batch remark): PENDING is the routine DNS-propagation window after identity creation and TEMPORARY_FAILURE means AWS is still retrying a previously-successful verification. Since the remediation deletes the identity, firing there would advise destroying a mid-onboarding identity. Evaluate also fails closed (abstains) when verification_status is absent from Metadata.
the provisioner Deleter (backend/provisioner/internal/remediation/delete/aws/ses.go) parses the identity name out of the ses-identity/\<region>/\<name> UID and calls sesv2.DeleteEmailIdentity(EmailIdentity: \<name>). Required IAM: ses:DeleteEmailIdentity. Idempotent on NotFoundException.
GuidedReviewInput (guided_review.go) now describes the action the executor actually performs: deleting the verified email identity (the sending address or domain itself), after which every message from that address/domain is rejected until it is re-verified (re-publishing DNS records for a domain). It previously claimed to delete only an idle SES "configuration set" and its per-set event tracking, leaving verified senders "unaffected", which is the wrong resource and severity for a DeleteEmailIdentity call. The preview items and EducateCopy are updated to high severit