# SES Global Endpoints — resource replication matrix

Legend: **Auto** = console duplication handles it | **Manual** = you must configure in secondary | **Both** = must exist identically | **N/A** = not required for MREP | **Primary-only** = managed in primary region only

| Resource | Replication | Notes |
|----------|-------------|-------|
| Domain identities (Easy DKIM) | Auto (DEED) | Deterministic Easy DKIM auto-verifies secondary after primary; no new DNS records |
| Domain identities (BYODKIM) | Manual | Recreate identity and upload keys in secondary; DEED does not apply |
| Email address identities | Manual | Verify individually in secondary or duplicate via console where supported |
| Easy DKIM tokens | Auto (DEED) | Same tokens across regions for parent Easy DKIM domains |
| BYODKIM keys | Manual | Per-region key material |
| Custom MAIL FROM | Manual | Configure in secondary after identity duplication |
| Configuration sets | Auto + Manual | Shell duplicated; event destinations, archiving, reputation options often **Manual** |
| Event destinations (SNS, Firehose, CloudWatch, EventBridge) | Manual | Not fully copied with config set duplication |
| Dedicated IP pools | Both | Pools must exist in both regions; keep both active for reputation |
| Managed dedicated IPs | Both | Request/provision in secondary; warm-up in both regions |
| Email templates | Manual | Duplicate templates referenced by sends |
| Contact lists | Manual | Not part of MREP duplication workflow |
| Account suppression list | N/A | Account-scoped; applies per region independently |
| Tenant-level suppression (2026) | Both | Tenant config per region if using Tenants |
| Virtual Deliverability Manager (VDM) | Both | Enable VDM in both regions for consistent metrics |
| Sending authorization policies | Manual | Identity policies per region |
| IAM send policies | Both | Scope to resources in both regions |
| Tenants | Manual | Create tenants and resource associations in secondary |
| Tenant resource associations (identity, config set) | Manual | `create-tenant-resource-association` per region |
| SMTP credentials | Manual | Per-region credentials; `X-SES-TENANT` header for tenant SMTP |
| CloudWatch metrics (regional) | Both | Regional metrics remain; use MREP dimension for unified view |
| SNS topics for bounces/complaints | Manual | Topics are regional — create in secondary or cross-region subscribe |
| EventBridge default bus rules | Manual | Tenant reputation findings route per region |
| CloudTrail | Both | Enable in both regions for audit |
| Secrets Manager (API keys) | N/A | App secret; not SES resource |
| KMS (BYODKIM signing) | Manual | Same or replica keys per your key policy |
| Multi-region endpoint (MREP) | Primary-only | Created and managed in primary region |
| Sending quota / rate | Both | Secondary must match primary; failover sends 100% to one region |
| Account-level sending pause | Both | Account status is per-region |
| Feedback forwarding | Manual | Per identity in secondary |
| Inbound receiving rules | N/A | MREP is outbound-only |
| Email archiving (Mail Manager) | Manual | Archive in secondary region with same name if enabled |

## Duplication console order (AWS documented)

1. Configuration sets
2. Verified domain identities
3. Production limits (via Service Quotas in secondary)

## Failover quota rule

Under normal operation traffic splits ~50/50. During impairment, **100%** routes to the healthy region. Size secondary **sending quota** and **sending rate** for full volume, not half.