This is a real story from a Vigilare customer — a SaaS startup running transactional email through Amazon SES. The details have been anonymized, but the timeline, the metrics, and the near-miss are real.
The Setup
The company is a B2B SaaS platform with about 2,000 customers. They send transactional emails through SES — signup confirmations, password resets, invoice notifications, and weekly product update digests. Email is a core part of their product experience. An SES suspension would mean no password resets, no invoices, and no signup confirmations — effectively locking new users out and breaking critical workflows for existing ones.
They'd been running Vigilare for about three months, primarily for billing monitoring and security alerts. SES reputation was one of the account health signals being tracked, but it had never triggered an alert — their bounce and complaint rates were consistently healthy.
The Incident: Friday, 3:47 PM
At 3:47 PM on a Friday, Vigilare fired a warning alert to their #aws-alerts Slack channel: SES bounce rate had jumped from a normal 1.2% to 5.3% over the past 6 hours. The account health score dropped from 82 to 67.
The engineering lead saw the alert and investigated. The cause: a weekly product digest email had been sent to their full customer list, and a significant portion of the recipient addresses were no longer valid. Many were from customers who had signed up months ago with work email addresses at companies that had since shut down or had employee turnover. The bounced emails pushed the bounce rate above 5% — the threshold where AWS starts paying attention.
The Response: Friday, 4:15 PM
Within 30 minutes of the alert, the team took three actions. First, they paused the digest email campaign to stop generating additional bounces. Second, they identified and removed 340 email addresses that had hard-bounced, cleaning their recipient list. Third, they implemented a bounce handling webhook that automatically suppresses addresses after a hard bounce, preventing the same addresses from being emailed again.
What Would Have Happened Without the Alert
SES enforcement follows a predictable path. At a 5% bounce rate, AWS places the account on a review period. At 10%, SES sending is paused — no emails go out until the issue is resolved. Above 10%, the account may face broader restrictions affecting services beyond SES.
Without Vigilare's alert, the bounce rate would have continued climbing as the digest emails continued sending over the weekend. By Monday morning, the bounce rate would have likely exceeded 10%. The team would have arrived to find SES sending paused, a backlog of unsent transactional emails, and customers unable to reset passwords or receive invoices.
Instead, they caught it at 5.3%, fixed the root cause within an hour, and the bounce rate recovered to 1.5% by Monday. No SES enforcement action was triggered. No customer impact.
The Technical Details
Vigilare monitors SES reputation through the CloudWatch AWS/SES namespace metrics: Reputation.BounceRate and Reputation.ComplaintRate. These metrics are checked at 5-minute intervals and compared against both AWS's enforcement thresholds and the account's historical baseline.
The alert fired because the bounce rate exceeded the warning threshold (5%) and because the rate of change was anomalous — a 4x increase in 6 hours against a normally stable baseline. This combination triggered a warning-level alert rather than informational, which is why it was routed to Slack rather than batched into a daily email.
What Changed After
The team implemented three permanent changes after this incident. They added a bounce-handling webhook to SES that automatically adds hard-bounced addresses to a suppression list. They now validate email addresses on signup using a real-time verification service. And they run their digest sends in smaller batches with bounce rate monitoring between batches, pausing automatically if the rate spikes.
The Vigilare alert was the trigger that made all of this happen. Without it, they would have learned about SES reputation through an outage — the worst possible way to discover a monitoring gap.
The Takeaway
SES reputation is one of the most overlooked account health signals. Most teams set up SES, verify their domain, and never think about bounce rates again — until sending is paused and they're scrambling to understand why. Monitoring SES metrics alongside security, billing, and compliance gives you a complete picture of account health. A bounce rate spike on Friday afternoon is a solvable problem. A sending suspension on Monday morning is a crisis.
If your startup relies on SES for transactional email, the question isn't whether you'll eventually have a reputation issue — it's whether you'll catch it before AWS does. Start a free 14-day Vigilare trial.
Related Reading
Protect your AWS accounts before it's too late
Vigilare monitors your AWS accounts for suspension risks — billing anomalies, IAM issues, GuardDuty findings, and more — and alerts you before AWS takes action.
Written by Viktor B.
Co-founder & CEO