Back to All Checks
Medium SES Regional

SES configuration sets should have TLS enabled for sending emails

Description

Flags Amazon SES configuration sets whose delivery options do not require TLS. When TLS is optional, SES falls back to unencrypted SMTP whenever the recipient mail server does not advertise STARTTLS, exposing message contents in transit.

Remediation

Set DeliveryOptions.TlsPolicy to REQUIRE on every SES configuration set.

Steps

  1. Open the Amazon SES console and choose Configuration sets.
  2. Select the configuration set and choose Edit.
  3. Under Delivery options, set TLS to Required.
  4. Save the changes.
Start Your Free Security Check