**End of support notice:** On October 30, 2026, AWS will end support for Amazon Pinpoint. After October 30, 2026, you will no longer be able to access the Amazon Pinpoint console or Amazon Pinpoint resources (endpoints, segments, campaigns, journeys, and analytics). For more information, see [Amazon Pinpoint end of support](https://docs.aws.amazon.com/console/pinpoint/migration-guide). **Note:** APIs related to SMS, voice, mobile push, OTP, and phone number validate are not impacted by this change and are supported by AWS End User Messaging.
# Setting up the Amazon Pinpoint email channel
To set up the Amazon Pinpoint email channel, you start by verifying the email address or domain that you want to use when you send email from that project. Next, you create a project, enable the email channel in that project, and choose an email address or domain to use.
When you enable the email channel for the first time, Amazon Pinpoint doesn't immediately provide production access for email messaging. Instead, your AWS account has access only to the email sandbox, which imposes restrictions on your email traffic. To gain production access, [submit a request](channels-email-setup-production-access.md) to Support.
Use the **Email** settings page to view information about email usage for your Amazon Pinpoint account, such as the number of emails that you've sent during the past 24 hours and whether there are sending restrictions on your account.
You can also use the **Email** settings page to enable or disable the email channel for the current project. If you disable the email channel for the project, you can't send email from campaigns or journeys in the project. However, you can send transactional email from your Amazon Pinpoint account. To enable Amazon Pinpoint to send email for your campaigns or journeys you must create or update an IAM role to allow Amazon Pinpoint to send email on your behalf through Amazon SES, see [Creating an email orchestration sending role in Amazon Pinpoint](channels-email-orchestration-sending-role.md).
In addition, you can use the **Email** settings page to verify email identities for the current project. In Amazon Pinpoint, an *identity* is an email address or domain that you use to send email. Every email address that you want to use as a *From*, *Source*, *Sender*, or *Return path* address in email has to be verified before you can send email with it by using Amazon Pinpoint.
**Topics**
+ [Creating an Amazon Pinpoint project with email support](channels-email-setup-create.md)
+ [Verifying email identities](channels-email-manage-verify.md)
+ [Creating an email orchestration sending role in Amazon Pinpoint](channels-email-orchestration-sending-role.md)
# Creating an Amazon Pinpoint project with email support
To send email with Amazon Pinpoint, you start by creating an Amazon Pinpoint project. When you create a project, you can enable the email channel for it, and then choose the email identity that you want to use as the sender address. If you haven't already verified an identity to use with Amazon Pinpoint, you can verify an email address when you create the project.
In Amazon Pinpoint, an *identity* is an email address or domain that you use to send email. Before you can send email using Amazon Pinpoint, you must verify each identity that you plan to use as a *From*, *Source*, *Sender*, or *Return path* address to prove that you own the identity. For more information about verifying identities, see [Verifying email identities](channels-email-manage-verify.md).
**Note**
If your account is still in the Amazon Pinpoint email sandbox, you also need to verify the identities that you plan to send email to. For more information about the email sandbox, see [Increasing your sending quotas](channels-email-manage-limits.md#channels-email-manage-limits-increase).
If you have already created the project you can enable email by following the directions at [Enabling and disabling the email channel](channels-email-enable.md).
**Topics**
+ [Creating an email project when you haven't yet verified an identity](#channels-email-setup-create-not-verified)
+ [Creating an email project when you've already verified an identity](#channels-email-setup-create-already-verified)
## Creating an email project when you haven't yet verified an identity
If you haven't used Amazon Pinpoint to send email in the past, you probably haven't verified any identities. The procedure in this section describes the process of creating a project and verifying a single email address at the same time.
If you've already verified an identity, or if you want to verify an entire domain instead of a single address, use the procedures in [Verifying a domain](channels-email-manage-verify.md#channels-email-manage-verify-domain) instead.
**To create a new email project and verify an email address**
1. Open the Amazon Pinpoint console at [https://console.aws.amazon.com/pinpoint/](https://console.aws.amazon.com/pinpoint/).
1. On the **All projects** page, choose **Create a project**.
1. For **Project name**, enter a name, and then choose **Create**.
**Note**
The project name can contain up to 64 alphanumeric characters. It can also include the following characters: comma (,), period (.), at sign (@), underscore (\$1), equals sign (=), and plus sign (\$1).
1. On the **Configure features** page, under **Email**, choose **Configure**.
1. On the **Set up email** page, for **Email address**, enter the email address that you want to use to send email from this project. Amazon Pinpoint sends an email to the address that you entered. Open the email, and then click the link in the message to verify the email address.
## Creating an email project when you've already verified an identity
If you've already verified an email identity, you can use that identity with your new project.
**To create a new email project and choose an existing identity**
1. Open the Amazon Pinpoint console at [https://console.aws.amazon.com/pinpoint/](https://console.aws.amazon.com/pinpoint/).
1. On the **All projects** page, choose **Create a project**.
1. For **Project name**, enter a name, and then choose **Create**.
**Note**
The project name can contain up to 64 alphanumeric characters. It can also include the following characters: comma (,), period (.), at sign (@), underscore (\$1), equals sign (=), and plus sign (\$1).
1. On the **Configure features** page, choose **Skip this step**.
1. In the navigation pane, under **Settings**, choose **Email**.
1. Next to **Identity details**, choose **Edit**.
1. Choose **Enable the email channel for this project**.
1. For **Identity type**, choose either **Email address** or **Domain**, depending on the type of verified identity that you want to use.
1. Choose **Use an existing email address** if you chose **Email address** in the preceding step, or choose **Use an existing domain** if you chose **Domain**.
1. From the list, choose the verified email address or domain that you want to use.
1. If you're setting up a domain, specify the **Default sender address** for that domain.
1. (Optional) For **Friendly sender name**, enter the name that you want to appear in your recipients' email clients.
1. When you finish, choose **Save**.
# Verifying email identities
In Amazon Pinpoint, an *identity* is an email address or domain that you use to send email. Before you can send email by using Amazon Pinpoint, you must verify each identity that you plan to use as a *From*, *Source*, *Sender*, or *Return path* address to prove that you own it. If your account is still in the Amazon Pinpoint sandbox, you also must verify the identities that you plan to send email to.
Before you verify an identity, you have to create a project and enable the email channel for the project. For more information, see [Creating an Amazon Pinpoint project with email support](channels-email-setup-create.md).
**Topics**
+ [Verifying an email address](#channels-email-manage-verify-email-address)
+ [Verifying a domain](#channels-email-manage-verify-domain)
## Verifying an email address
If you've already created a project for sending email, you probably already verified an email address. You can verify a different email address by using the Amazon Pinpoint console.
**To verify an email address**
1. Open the Amazon Pinpoint console at [https://console.aws.amazon.com/pinpoint/](https://console.aws.amazon.com/pinpoint/).
1. In the navigation pane, under **Email**, choose **Email identities**.
1. Choose **Verify email identity**.
1. Under **Identity type**, choose **Email address**.
1. For **Verify a new email address**, enter the email address that you want to verify.
1. Choose **Verify email address**.
1. Check the inbox of the address that you entered and look for an email from *no-reply-aws@amazon.com*. Open the email and select the link in the email to complete the verification process for the email address.
**Note**
You should receive the verification email within five minutes. If you don't receive the email, do the following:
Make sure you typed the address correctly.
Make sure the email address that you're attempting to verify can receive email. You can test this by using another email address to send a test email to the address that you want to verify.
Check your junk mail folder.
The link in the verification email expires after 24 hours. To resend the verification email, choose **Send verification email again**.
When you verify an email address, consider the following:
+ Amazon Pinpoint has endpoints in multiple AWS Regions and the verification status of an email address is separate for each Region. If you want to send email from the same identity in more than one Region, you must verify that identity in each Region. You can verify as many as 10,000 identities (email addresses and domains, in any combination) in each AWS Region.
+ The *local part* of the email address, which is the part that precedes the at sign (@), is case sensitive. For example, if you verify *user@example.com*, you can't send email from *USER@example.com* unless you verify that address too.
+ Domain names are case insensitive. For example, if you verify *user@example.com*, you can also send emails from *user@EXAMPLE.com*.
+ You can apply labels to verified email addresses by adding a plus sign (\$1) followed by a string of text after the local part of the address and before the at sign (@). For example, to apply *label1* to the address *user@example.com*, use *user\$1label1@example.com*. You can use as many labels as you want for each verified address. You can also use labels in the *From* and *Return path* fields to implement Variable Envelope Return Path (VERP).
**Note**
When you verify an unlabeled address, you're verifying all addresses that could be formed by adding a label to the address. However, if you verify a labeled address, you can't use other labels with that address.
## Verifying a domain
When you verify a domain, you verify all the email addresses that are associated with that domain. Therefore, you don't need to verify individual email addresses from the domain. For example, if you verify the *example.com* domain, you can send email from *carlos@example.com*, *jane@example.com*, and any other address from the *example.com* domain.
Before you can use Amazon Pinpoint to send email from a domain, you have to verify the domain to confirm that you own it and to prevent others from using it.
**Note**
To complete the verification process, you must be able to modify the DNS settings for the domain. The procedures for modifying the DNS settings for a domain vary depending on the DNS or web hosting provider. For information about changing the DNS settings for your domain, see the documentation for your provider.
**To verify a domain**
1. Open the Amazon Pinpoint console at [https://console.aws.amazon.com/pinpoint/](https://console.aws.amazon.com/pinpoint/).
1. In the navigation pane, under **Email**, choose **Email identities**.
1. Choose **Verify email identity**.
1. Under **Identity type**, choose **Domain**, and then choose **Verify a new domain**.
1. For **Domain**, enter the domain that you want to verify.
1. Choose **Verify domain**.
1. Under **Record set**, copy the three CNAME records and save them to a location on your computer. Or, to download and save the values in a .csv file, choose **Download record set**.
1. Log in to the management console for your DNS or web hosting provider, and then create three new CNAME records that contain the values that you saved in the previous step. See the next section for links to the documentation for several common providers.
1. When Amazon Pinpoint detects all three of these CNAME records in the DNS configuration of your domain, the verification process is complete. You can check the verification status by returning to the **Email identities** page. In the **All identities** table, locate the domain that you attempted to verify. If the value in the **Status** column for that domain is *Active*, the verification process is complete.
**Note**
In some cases, it can take 72 hours or more for DNS changes to propagate across the internet. You can't send email from a domain until the verification process is complete.
When you verify a domain, consider the following:
+ You can send email from any subdomain of the verified domain, without verifying the subdomain specifically. For example, if you verify *example.com*, you don't need to verify *a.example.com* or *a.b.example.com*.
+ As specified in [RFC 1034](https://datatracker.ietf.org/doc/html/rfc1034), each DNS label can have up to 63 characters. In addition, the whole domain name must not exceed a total length of 255 characters.
+ Amazon Pinpoint is available in multiple AWS Regions, and the verification status of a domain is separate for each Region. If you want to send email from the same identity in more than one Region, you must verify that identity in each Region. You can verify as many as 10,000 identities (domains and email addresses, in any combination) in each AWS Region.
### Instructions for configuring DNS records for various providers
The procedures for updating the DNS records for a domain vary depending on which DNS or web hosting provider you use. The following table lists links to the documentation for several common providers. This list isn't exhaustive and inclusion in this list isn't an endorsement or recommendation of any company's products or services. If your provider isn't listed in the table, you can probably use the domain with Amazon Pinpoint.
| DNS/hosting provider | Documentation link |
| --- | --- |
| Amazon Route 53 | [Working with records](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/rrsets-working-with.html) |
| GoDaddy | [Add a CNAME record](https://www.godaddy.com/help/add-a-cname-record-19236) (external link) |
| Dreamhost | [How do I add custom DNS records?](https://help.dreamhost.com/hc/en-us/articles/360035516812-Adding-custom-DNS-records) (external link) |
| Cloudflare | [Managing DNS records in cloudflare](https://developers.cloudflare.com/dns/manage-dns-records/how-to/create-dns-records) (external link) |
| HostGator | [Manage DNS records with HostGator/eNom](https://www.hostgator.com/help/article/manage-dns-records-with-hostgatorenom) (external link) |
| Namecheap | [How do I add TXT/SPF/DKIM/DMARC records for my domain? ](https://www.namecheap.com/support/knowledgebase/article.aspx/317/2237/how-do-i-add-txtspfdkimdmarc-records-for-my-domain/) (external link) |
| Names.co.uk | [Changing your domains DNS settings](https://www.names.co.uk/support/articles/changing-your-domains-dns-settings/) (external link) |
| Wix | [Adding or Updating CNAME Records in Your Wix Account](https://support.wix.com/en/article/adding-or-updating-cname-records-in-your-wix-account) |
### Domain verification tips and troubleshooting
If you completed the preceding steps but your domain isn't verified after 72 hours, check the following:
+ Make sure that you entered the values for the DNS records in the correct fields. Some providers refer to the **Name/host** field as *Host* or *Hostname*. In addition, some providers refer to the **Record value** field as *Points to* or *Result*.
+ Make sure that your provider didn't automatically append your domain name to the **Name/host** value that you entered in the DNS record. Some providers append the domain name without indicating that they've done so. If your provider appended your domain name to the **Name/host** value, remove the domain name from the end of the value. You can also try adding a period to the end of the value in the DNS record. This period indicates to the provider that the domain name is fully qualified.
+ The underscore character (\$1) is required in the **Name/host** value of each DNS record. If your provider doesn't allow underscores in DNS record names, contact the provider's customer support department for additional assistance.
+ The validation records that you have to add to the DNS configuration for your domain are different for each AWS Region. If you want to use a domain to send email from multiple AWS Regions, you have to verify the domain in each of those Regions.
# Creating an email orchestration sending role in Amazon Pinpoint
Amazon Pinpoint uses your Amazon SES resources for sending email messages that are either part of a campaign or a journey. To set up Amazon Pinpoint to use your Amazon SES resources to send email, create or update an IAM role to grant Amazon Pinpoint access.
**Note**
You only have to create an **Orchestration sending role arn** if you're sending emails from a campaign or a journey. For direct send email, you must have permissions for `ses:SendEmail` and `ses:SendRawEmail`.
**Create orchestration sending role arn**
1. Open the Amazon Pinpoint console at [https://console.aws.amazon.com/pinpoint/](https://console.aws.amazon.com/pinpoint/).
1. On the **All projects** page, choose the project that you want to update email settings for.
1. In the navigation pane, under **Settings**, choose **Email**.
1. On the **Identities** tab, choose **Edit**.
1. Choose **Enable campaigns and journeys for this email channel**.
1. For **IAM role** choose either:
+ **Create a new role** (Recommended) – To have Amazon Pinpoint create the IAM role and configure the IAM roles permissions. Enter a name for the IAM role in **IAM role name**.
+ **Use an existing role** – If you have an existing IAM role that already contains permissions to allow Amazon Pinpoint access to `ses:SendEmail` and `ses:SendRawEmail` then choose that IAM role from the drop down list. If you need to create the IAM role, see [IAM role for sending email through Amazon SES](https://docs.aws.amazon.com/pinpoint/latest/developerguide/permissions-ses.html) in the [Amazon Pinpoint Developer Guide](https://docs.aws.amazon.com/pinpoint/latest/developerguide/).
1. Choose **I acknowledge that the IAM role I selected has the required permissions.**
1. Choose **Save**.
## Deleting an email orchestration sending role in Amazon Pinpoint
You can delete the **Orchestration sending role arn** when you don't want to send email messages for the project. To delete the **Orchestration sending role arn**, delete the email channel from the project.
**Important**
This action deletes the email channel from your project. Only do this if you don't want to send emails from a campaign or a journey.
To delete the email channel, use the [delete-email-channel](https://docs.aws.amazon.com/cli/latest/reference/pinpoint/delete-email-channel.html) command:
```
aws pinpoint delete-email-channel --application-id application-id
```
Where:
+ *application-id* is the ID of the Amazon Pinpoint project that contains the email channel.
The response to this command is the JSON definition of the email channel that you deleted.
## Find your email orchestration sending role ARN in Amazon Pinpoint
For Amazon Pinpoint to begin email through Amazon SES, delegate the required permissions to Amazon Pinpoint. When the IAM role is set up, Amazon Pinpoint uses the **Orchestration sending role arn** to send email through Amazon SES. If the **Orchestration sending role arn** is present, then the project has delegated the permissions to Amazon Pinpoint.
1. Open the Amazon Pinpoint console at [https://console.aws.amazon.com/pinpoint/](https://console.aws.amazon.com/pinpoint/).
1. On the **All projects** page, choose the project that you want to update email settings for.
1. In the navigation pane, under **Settings**, choose **Email**.
1. On the **Identities** tab, you can view your **Orchestration sending role arn**.