Contents of notifications for Amazon SES email receiving - Amazon Simple Email Service
Top-level JSON objectreceipt objectmail object

Contents of notifications for Amazon SES email receiving

All notifications for email receiving are published to Amazon Simple Notification Service (Amazon SNS) topics in JavaScript Object Notation (JSON) format.

For example notifications, see Notification examples.

Top-level JSON object

The top-level JSON object contains the following fields.

Field Name Description
notificationType

The notification type. For this type of notification, the value is always Received.

receipt

Object that contains information about the email delivery.

mail

Object that contains information about the email associated with the notification.

content

String that contains the raw, unmodified email, which is typically in Multipurpose Internet Mail Extensions (MIME) format. For more information about MIME format, see RFC 2045.

Note

This field is present only if the notification was triggered by an SNS action. Notifications triggered by all other actions do not contain this field.

receipt object

The receipt object has the following fields.

Field Name Description

action

Object that encapsulates information about the action that was executed. For a list of possible values, see action object.

dkimVerdict

Object that indicates whether the DomainKeys Identified Mail (DKIM) check passed. For a list of possible values, see dkimVerdict object.
dmarcPolicy

Indicates the Domain-based Message Authentication, Reporting & Conformance (DMARC) settings for the sending domain. This field only appears if the message fails DMARC authentication.

Possible values for this field are:

  • none: The owner of the sending domain requests that no specific action be taken on messages that fail DMARC authentication.

  • quarantine: The owner of the sending domain requests that messages that fail DMARC authentication be treated by receivers as suspicious.

  • reject: The owner of the sending domain requests that messages that fail DMARC authentication be rejected.
dmarcVerdict Object that indicates whether the Domain-based Message Authentication, Reporting & Conformance (DMARC) check passed. For a list of possible values, see dmarcVerdict object.
processingTimeMillis

String that specifies the period, in milliseconds, from the time Amazon SES received the message to the time it triggered the action.
recipients

The recipients (specifically, the envelope RCPT TO addresses) that were matched by the active receipt rule. The addresses listed here may differ from those listed by the destination field in the mail object.

spamVerdict

Object that indicates whether the message is spam. For a list of possible values, see spamVerdict object.

spfVerdict

Object that indicates whether the Sender Policy Framework (SPF) check passed. For a list of possible values, see spfVerdict object.
timestamp

String that specifies the qualified date and time at which the action was triggered, in ISO 8601 format.

virusVerdict

Object that indicates whether the message contains a virus. For a list of possible values, see virusVerdict object.

action object

The action object has the following fields.

Field Name Description
type

String that indicates the type of action that was executed. Possible values are S3, SNS, Bounce, Lambda, Stop, and WorkMail.
topicArn

String that contains the Amazon Resource Name (ARN) of the Amazon SNS topic to which the notification was published.
bucketName

String that contains the name of the Amazon S3 bucket to which the message was published. Present only for the S3 action type.
objectKey

String that contains a name that uniquely identifies the email in the Amazon S3 bucket. This is the same as the messageId in the mail object. Present only for the S3 action type.
smtpReplyCode

String that contains the SMTP reply code, as defined by RFC 5321. Present only for the bounce action type.
statusCode

String that contains the SMTP enhanced status code, as defined by RFC 3463. Present only for the bounce action type.
message

String that contains the human-readable text to include in the bounce message. Present only for the bounce action type.
sender

String that contains the email address of the sender of the email that bounced. This is the address from which the bounce message was sent. Present only for the bounce action type.
functionArn

String that contains the ARN of the Lambda function that was triggered. Present only for the Lambda action type.
invocationType

String that contains the invocation type of the Lambda function. Possible values are RequestResponse and Event. Present only for the Lambda action type.
organizationArn

String that contains the ARN of the Amazon WorkMail organization. Present only for the WorkMail action type.

dkimVerdict object

The dkimVerdict object has the following fields.

Field Name Description
status

String that contains the DKIM verdict. Possible values are:

  • PASS: The message passed DKIM authentication.

  • FAIL: The message failed DKIM authentication.

  • GRAY: The message is not DKIM-signed or the from domain and DKIM-signature domain do not match.

  • PROCESSING_FAILED: There is an issue that prevents Amazon SES from checking the DKIM signature. For example, DNS queries are failing or the DKIM signature header is not formatted properly.

dmarcVerdict object

The dmarcVerdict object has the following fields.

Field Name Description
status

String that contains the DMARC verdict. Possible values are:

  • PASS: The message passed DMARC authentication.

  • FAIL: The message failed DMARC authentication.

  • GRAY: At least one of SPF or DKIM passed authentication, but the sending domain does not have a DMARC policy or uses the p=none policy.

  • PROCESSING_FAILED: There is an issue that prevents Amazon SES from providing a DMARC verdict.

spamVerdict object

The spamVerdict object has the following fields.

Field Name Description
status

String that contains the result of spam scanning. Possible values are:

  • PASS: The spam scan determined that the message is unlikely to contain spam.

  • FAIL: The spam scan determined that the message is likely to contain spam.

  • GRAY: Amazon SES scanned the email but could not determine with confidence whether it is spam.

  • PROCESSING_FAILED: Amazon SES was unable to scan the email. For example, the email is not a valid MIME message.

spfVerdict object

The spfVerdict object has the following fields.

Field Name Description
status

String that contains the SPF verdict. Possible values are:

  • PASS: The message passed SPF authentication.

  • FAIL: The message failed SPF authentication.

  • GRAY: The SPF result is none, softfail, or neutral.

  • PROCESSING_FAILED: There is an issue that prevents Amazon SES from checking the SPF record. For example, DNS queries are failing.

virusVerdict object

The virusVerdict object has the following fields.

Field Name Description
status

String that contains the result of virus scanning. Possible values are:

  • PASS: The message does not contain a virus.

  • FAIL: The message contains a virus.

  • GRAY: Amazon SES scanned the email but could not determine with confidence whether it contains a virus.

  • PROCESSING_FAILED: Amazon SES is unable to scan the content of the email. For example, the email is not a valid MIME message.

mail object

The mail object has the following fields.

Field Name Description
destination

A complete list of all recipient addresses (including To: and CC: recipients) from the MIME headers of the incoming email.
messageId

String that contains the unique ID assigned to the email by Amazon SES. If the email was delivered to Amazon S3, the message ID is also the Amazon S3 object key that was used to write the message to your Amazon S3 bucket.
source

String that contains the email address (specifically, the envelope MAIL FROM address) that the email was sent from.
timestamp

String that contains the time at which the email was received, in ISO8601 format.
headers

The Amazon SES headers and your custom headers. Each header has the following fields: name and value.

commonHeaders

The headers common to all emails. Each header has the following fields: name and value.
headersTruncated

Specifies whether the headers were truncated in the notification, which happens if the headers are larger than 10 KB. Possible values are true and false.

commonHeaders object

The commonHeaders object can have the fields shown in the following table. The fields present in this object vary depending on which fields were present in the incoming email.

Field Name Description
messageId

The ID of the original message.
date

The date and time when Amazon SES received the message.
to

The To header of the email.
cc

The CC header of the email.
bcc

The BCC header of the email.
from

The From header of the email.
sender

The Sender header of the email.
returnPath

The Return-Path header of the email.
replyTo

The Reply-To header of the email.
subject

The Subject header of the email.