Amazon SES 554 Message: Rejected Email Address is not Verified

The full error from the SMTP interface looks like:

554 Message rejected: Email address is not verified. The following
identities failed the check in region US-EAST-1: sender@example.com

Over the SES API/SDK the same condition surfaces as HTTP 400 with the error type MessageRejected (a MessageRejectedException in most SDKs) — the 554 is specifically what the SMTP endpoint returns (a permanent rejection; RFC 5321 §4.2.1 defines the 5yz severity class, and §4.2.3 lists 554 "Transaction failed" by number).

What causes Amazon SES "Email address is not verified"?

Per the SES Developer Guide, SES raises this when:

• The sender identity isn't verified. You're sending from an address or domain that hasn't been verified in SES. This applies to the From, Source, Sender, or Return-Path address — any one of them being unverified triggers the error.
• Your account is in the SES sandbox and the recipient isn't verified. New accounts start in the sandbox, where you must verify every recipient too — not just the sender. (Mailbox-simulator addresses like success@simulator.amazonses.com are the only exception.)
• Wrong AWS Region. Verification status is per-Region. An identity verified in us-east-1 is not verified in eu-west-1; sending through the wrong Region's endpoint fails the check.
• Address mismatch / typo. The address on the message must match a verified identity exactly. The identities listed after "failed the check in region" tell you precisely which ones SES rejected (a trailing ellipsis means the list was truncated).

How do I fix Amazon SES 554 "Email address is not verified"?

1. Confirm the sender identity is verified. In the SES console under Verified identities, check that the address or domain shows status Verified (not Pending or Failed). Re-verify if needed.
2. Match the Region. Make sure the Region in your SDK/SMTP endpoint is the same Region where the identity is verified. Verify the identity in every Region you send from.
3. If you're in the sandbox, either verify the recipient too, or request production access. Production access removes the recipient-verification requirement (and raises sending quotas). Request it from the console under Account dashboard → Request production access.
4. Check the failing identities named in the error and fix any typos so the message addresses match a verified identity exactly.

The SDK call itself is correct once the identity and Region line up:

const { SESClient, SendEmailCommand } = require('@aws-sdk/client-ses');

// Region MUST match where the identity is verified
const ses = new SESClient({ region: 'us-east-1' });

await ses.send(new SendEmailCommand({
  Source: 'verified-sender@example.com', // a Verified identity in this Region
  Destination: { ToAddresses: ['recipient@example.com'] }, // also verified if in sandbox
  Message: {
    Subject: { Charset: 'UTF-8', Data: 'Hello' },
    Body: { Html: { Charset: 'UTF-8', Data: 'This is the body of my email!' } },
  },
}));

If you route SES through Courier, configure the verified sending address (and correct Region) on the Amazon SES provider in your Courier settings so it matches a Verified identity.