# SES B2B Outbound / Cold Outreach — Compliance & Deliverability Checklist

First-party checklist for the post **Amazon SES Cold Email for B2B: Compliance and Deliverability (2026)**.

**Scope:** Legitimate B2B outbound (sales / partnership / recruiting) on Amazon SES. Not a spam playbook.

**As of:** 2026-07-22. Re-check [AWS SES pricing](https://aws.amazon.com/ses/pricing/), mailbox-provider bulk-sender pages, and counsel for your jurisdictions before production send.

## 0. Legal / policy gates (stop if any fail)

- [ ] Counsel (or designated privacy owner) approved the outreach program for **CAN-SPAM**, **CASL**, **GDPR/UK GDPR**, and any state/local rules that apply to your list sources
- [ ] Recipients are **business contacts** with a documented acquisition path (conference, referral, public role email, opt-in) — not purchased consumer lists
- [ ] Every message identifies the sender legal entity and a working physical postal address
- [ ] Every message includes a clear unsubscribe / opt-out path; marketing-style blasts honor opt-out within required timelines
- [ ] You will **not** continue sending after a hard bounce or explicit opt-out

## 1. SES account readiness

- [ ] Production access approved (out of sandbox) with realistic daily quota for ramp
- [ ] Verified sending domain(s) with Easy DKIM (2048-bit preferred) or BYODKIM
- [ ] Custom MAIL FROM domain configured and aligned
- [ ] SPF includes Amazon SES include; total DNS lookups ≤ 10
- [ ] DMARC published at minimum `p=none` with rua reporting; roadmap to enforcement if you want BIMI later
- [ ] Configuration set(s) created: at least `outbound-b2b` (and separate `transactional` if you share the account)
- [ ] SNS → Lambda (or equivalent) handles bounce + complaint → suppression store before next send
- [ ] CloudWatch alarms on bounce ~5% and complaint ~0.1% (SES account risk) plus Gmail Postmaster spam rate if volume warrants

## 2. IP and reputation isolation

- [ ] Decision recorded: **shared SES pool** vs **dedicated / managed DIP**
- [ ] If dedicated IPs needed: model **a-la-carte DIP fees** vs **SES Pro** plan (Jul 21, 2026+) — see pricing-plans post
- [ ] Outbound stream isolated from password-reset / invoice transactional IPs
- [ ] Warm-up schedule written (start engaged/known contacts; ramp daily volume; pause on complaint spikes)

## 3. Mailbox-provider bulk-sender bars (2024–2026)

Applies when volume approaches ~5k+/day to consumer domains (Gmail, Yahoo, Outlook.com):

- [ ] SPF + DKIM + DMARC alignment verified on live messages (check Authentication-Results)
- [ ] One-click unsubscribe headers (**RFC 8058**) on marketing-style sequences
- [ ] Microsoft Outlook consumer rules considered (**enforcement May 5, 2025**)
- [ ] Gmail Postmaster Tools property verified for sending domain
- [ ] Spam/complaint signals labeled correctly:
  - SES feedback complaint ~**0.1%** (account risk)
  - Gmail Postmaster spam rate under **0.10%**
  - Published bulk-sender guidance also cites **<0.3%** spam complaints — do not conflate with SES

## 4. List hygiene

- [ ] No role accounts / known spam traps in first warm-up waves when avoidable
- [ ] Hard bounces suppressed immediately; soft bounces capped then suppressed
- [ ] Re-permission / sunset policy for non-responders (document days of silence)
- [ ] Sending cadence documented (max touches / week / contact)

## 5. Content and technical headers

- [ ] From domain matches brand the recipient expects
- [ ] Plain-text alternative present; HTML not image-only
- [ ] Tracking domains (open/click) do not break DMARC alignment
- [ ] Message tags / configuration set name on every send for forensics

## 6. Go-live gate

- [ ] Dry-run to seed inboxes (Gmail, Outlook, Yahoo) — authentication + placement spot-check
- [ ] On-call owner named for reputation alarms during first 14 days
- [ ] Rollback plan: pause configuration set / throttle API if complaint rate spikes

## What this checklist is not

- Not legal advice
- Not permission to run unsolicited consumer spam
- Not a guarantee of inbox placement