Amazon SES Review for Spam Traps: What AWS Wants and How Long It Takes

If SES put your account under review for spam traps, AWS won't tell you which addresses or how many. It wants you to remove the parts of the list that traps come from (old, unengaged, bought, scraped or typo-filled segments), reply to the Support Center case with what you changed, and wait: AWS says it can take three weeks or more to see whether the hits stopped. Verify the list before any reconfirmation email, because AWS itself warns that one can raise your bounce rate.

All quotes below are from AWS's sending review FAQ, spamtrap section, read 2 November 2026.

What AWS says about trap reviews

• Where the reports come from: "Certain organizations that operate spamtraps send SES notifications when their spamtraps are hit by SES senders."
• The threshold: "We don't disclose the specific number of spamtrap hits that cause us to take action on your account."
• The addresses: "Spamtrap organizations disclose only the occurrence of spamtrap hits, not the actual spamtrap addresses."
• The timing: "Because of the way that spamtrap hits are reported, it may take three weeks or more before we are able to determine if the changes you made solved the issue."
• Severe cases: SES "might pause your account's ability to send email immediately, without placing your account under review first."

Where the traps in your list came from

AWS describes how traps are set up. Each route points to a segment you can cut:

How AWS says traps are made	The segment to cut
"Converted from addresses that were once valid, but have been unused (and bouncing) for an extended period"	Addresses that bounced before and were never removed, and anyone not mailed in a long time
"Addresses that are close to real addresses (for example, introducing a typo into a common domain name)"	Signups with typo domains like gmial.com or hotmial.com
Addresses "seeded" on the internet	Anything scraped from websites, or bought from someone who scraped it
Addresses "set up just to be spamtraps"	Bought, rented or shared lists. AWS: "Do not buy, rent, or share email addresses."

The fix, in order

1. Pause sends to anything you can't trace to an opt-in. Imports, partner lists, old CRM exports, event scans without consent.
2. Remove previous hard bounces from every list and segment. SES's account-level suppression list helps for new sends, but old exports and other tools may still hold them. Our suppression list guide covers merging them.
3. Cut the dormant segment. AWS: "if users haven't opened or clicked your emails in several months, you should consider removing them unless you have evidence that they do want your mail." Our sunset policy guide sets the windows.
4. Verify what's left. Run the list through the verify page to remove invalid addresses, dead domains and disposable addresses. This won't find a pristine trap, which is a working mailbox, but it removes the bouncing addresses that recycled traps grow from. Fix typo domains in the existing list with the email typo corrector, and stop new ones with double opt-in.
5. Fix the signup form. AWS recommends double opt-in, and asking for the address twice on web forms.
6. Reply to the case. State the root cause, the segments removed, the controls added, and why they stop new trap addresses getting in.

The reconfirmation email trap

AWS lists one more option: "Send an opt-in message to your entire mailing list and keep only the recipients who click on the verification link." Then it adds the caveat: "we don't recommend using this technique if you think that your mailing list might contain a lot of bad addresses, or if your account already has a problem with bounces, because it might cause your account's bounce rate to increase further."

So verify first, remove the invalid rows, and send the reconfirmation only to the part of the list that is valid and was engaged recently. AWS also warns that re-engagement campaigns "tend to be highly risky" for traps, bounces and complaints. Our post on mailing an old list has a staged restart plan.

Related SES reviews

Bounce reviews start at a 5% bounce rate (see SES bounce reviews), and complaint reviews can come from complaints your dashboard doesn't count (see SES reviews for direct complaints).

What SimpleVerifier costs

The first 100 checks are free with a Google sign-in. Pro is $39 a month with the first 100,000 checks a month at full speed, then slower, never cut off, and one-time packs of 10,000 checks for $15 never expire. See pricing.