# MREP readiness checklist (SES Global Endpoints)

Use before creating a multi-region endpoint (MREP). All gates must pass in the **primary** region first; secondary alignment follows console duplication order.

## API and transport prerequisites

- [ ] All production send paths use **SES API v2** (`SendEmail`, `SendBulkEmail`) — not SMTP
- [ ] No dependency on **VPC interface endpoints** for SES send (MREP does not support VPC endpoint access)
- [ ] Application SDK pinned to a version that supports `endpoint-id` parameter (AWS SDK for Java 2.x, boto3 1.35+, etc.)
- [ ] HTTP client **connection TTL ~60s** and DNS positive cache TTL ~60s configured (JVM: `networkaddress.cache.ttl`)

## IAM and service-linked roles

- [ ] Policy allows `iam:CreateServiceLinkedRole` for `ses.amazonaws.com` (one-time account setup)
- [ ] Send IAM policies scoped to identities and configuration sets used in both regions
- [ ] CloudTrail enabled in both regions for `sesv2:*` audit trail

## Primary region baseline

- [ ] Production access (out of sandbox) in primary region
- [ ] All sending domains verified with **Easy DKIM** (required parent for DEED secondary auto-verify)
- [ ] Configuration sets created with event destinations defined
- [ ] Dedicated IP pools provisioned and warmed if used
- [ ] Sending quota and rate in primary region documented (Service Quotas console)

## Secondary region alignment (console duplication order)

1. [ ] **Duplicate configuration sets** — then manually fix event destinations, archiving, reputation options not copied
2. [ ] **Duplicate verified domain identities** — DEED auto-verifies Easy DKIM parents; BYODKIM requires manual recreation
3. [ ] **Duplicate production limits** — secondary quota must handle **100% volume** during failover (not 50%)

## Per-identity manual follow-up (if applicable)

- [ ] Custom MAIL FROM domain configured in secondary
- [ ] Feedback forwarding / SNS notifications replicated
- [ ] BYODKIM keys uploaded in secondary (DEED N/A)
- [ ] Email templates duplicated if referenced by sends

## MREP creation

- [ ] Primary and secondary regions selected (latency-balanced relative to app if possible)
- [ ] MREP created via console or `aws sesv2 create-multi-region-endpoint`
- [ ] Endpoint status = **READY** before cutover
- [ ] Endpoint ID copied for application config (`endpoint-id` on SendEmail)

## Application integration

- [ ] Staging sends tested with `endpoint-id` against low-volume list
- [ ] Failover drill completed per [failover-test-runbook.md](./failover-test-runbook.md)
- [ ] CloudWatch dashboard uses dimension `ses:multi-region-endpoint-id`
- [ ] Rollback path documented: remove `endpoint-id` to revert to regional sends

## When NOT to enable MREP

- [ ] Volume < 100k/mo and no SLA on email delivery → regional SES is sufficient
- [ ] SMTP-only integrations with no API v2 migration plan
- [ ] Single-region compliance mandate (data must not leave region)