I spent last week trying to get my service yovico.com hosted on AWS, to send email.
Not a marketing email, but an account confirmation email. Someone signs up, the system mails him a link, he confirms. That is the whole game. Not a campaign, not a newsletter. One transactional message, the kind that says "confirm your address by clicking on this link." Perhaps an occasional one-time code, too.
Amazon SES turned me down. They asked for more details, then three days of silence followed. Then this:
...we identified some concerns that prevent us from approving your request. Due to security reasons, we are unable to provide specific details about our assessment criteria.
The "request" they were referring to was a limit increase. I actually hadn't asked for an increase. I had asked to leave the sandbox, the holding pen SES puts you in while it decides whether you are a spammer. In there you can only send to addresses you've verified to yourself. Nobody real ever sees the mail. I obviously needed to send to my actual users with emails not known yet.
So they answered a different question with the wrong template.
That's the whole thing. "Concerns." "Security reasons." A link to the Acceptable Use Policy. A link to the Service Terms. The signature reads "CS Digital Messaging." A job title with no human attached. At the end, they asked me to rate the correspondence.
(I gave it what it deserved, one star.)
My domain was verified, DKIM and SPF and DMARC all green. Expected volume under a hundred messages a day. None of it counted. To send mail to my own users I had to prove I was not a spammer to a system that would not tell me what it suspected, in a reply that wasn't even about the thing I asked.
A week. To enable my system to send a confirmation link or a code.
Then it struck me. Email is not a communication tool anymore. It is an identity service masquerading as a communication medium.
Check your inbox. When did you last get email from a friend in there? You text everybody now. Everyone has several instant messengers running. Facebook, Telegram, Teams, Signal, WhatsApp, you name it. The human part of email left years ago and didn't come back. Two things stayed. Institutional regulation-compliant spam, and one-time codes. Approved mass marketing you put up with, and verification you depend on. The peer is gone. Everything in a modern inbox is sent by a robot.
The codes are the tell. I made this case about 2FA once. It was never about security, it was a way to bind an account to one person. Email is the channel the verification runs on.
So email didn't die. It metamorphosed, and unfortunately it did not turn into a butterfly. The result is Kafkaesque.
Your address is your login nearly everywhere. It is your password reset. Lose it and you lose every account that hangs from it. It carries more weight than it ever has and you never think about it. And unlike your phone number, it is not even portable. It is captured.
This is also why sending is hard. The receivers are mostly Google and Microsoft. They sit in front of almost every inbox on earth. They spent twenty years building walls against spam, and those walls cannot tell a six-digit verification code or an account confirmation email from a marketing blast. A sender they don't recognize gets a poor reputation by default. They assume the worst about him, because most senders they don't recognize are the worst. So the most legitimate mail there is, a code a person asked for thirty seconds ago, has to fight through defenses built to stop the junk that wrecked email as a communication medium in the first place.
I was not sending an email. I was verifying a credential. The mailbox is the disguise.