AWS SES tenant-level suppression lists: what they are and how to use them
In June 2026 Amazon SES added tenant-level suppression lists — a separate suppressed-address list per tenant, instead of one shared account-wide list. If you send for multiple brands or clients on one SES account, this is the isolation you have been missing.
- · No cross-client bleed
- · Cleaner reporting
- · Same hygiene, finer grain
The three levels, in plain terms
SES suppression stops you from re-emailing addresses that already bounced or complained. Until recently it lived at two levels; now there are three, and they nest.
How suppression nests
- 01 Account-level One list for the whole account, per Region
- 02 Configuration-set Overrides which reasons add to the list
- 03 Tenant-level A separate list per tenant — full isolation
By default every tenant uses the account-level list. Enable tenant-level suppression and SES keeps a separate list for that tenant instead.
When to use which
| Level | Scope | Best for |
|---|---|---|
| Account-level | Whole account / Region | Single brand, one sending reputation |
| Configuration-set | Per config set | Tuning which bounce/complaint reasons suppress |
| Tenant-level | Per tenant | Agencies / SaaS sending for many clients |
Turning on tenant-level suppression
- 01
Confirm you use SES multi-tenancy
Tenant-level suppression applies to SES tenants. If you send for multiple clients on one account, you likely want tenants anyway.
- 02
Enable it per tenant
Call the PutTenantSuppressionAttributes API operation to switch a tenant from the shared account list to its own isolated list.
- 03
Decide the reasons
Choose whether bounces, complaints, or both add addresses to that tenant's list — the same reason controls you already use at account level.
- 04
Wire your bounce/complaint loop
Keep SES → SNS → SQS feeding suppression so each tenant's list stays current automatically, without manual cleanup.
Result: one client's hard bounce never silences a perfectly good address for another client on the same account.
Why it matters
No cross-client bleed
A bounce in tenant A no longer suppresses that address in tenant B. Reputation and lists stay scoped to each brand.
Cleaner reporting
Per-tenant suppression makes per-client deliverability legible — you can show each client their own list health.
Same hygiene, finer grain
It is the suppression you already trust, just isolated. The bounce/complaint automation pattern doesn't change.
Frequently asked
No. Account-level suppression is enough for a single sender. Tenant-level pays off when one SES account sends for multiple brands or clients that should not share a suppressed-address list.
Enabling tenant-level suppression gives that tenant its own list going forward; plan a backfill if you need existing account-level entries reflected per tenant. Test on one tenant first.
Configuration-set suppression changes which reasons add to the account list — it is not a separate list. Tenant-level suppression is a genuinely separate list scoped to one tenant.
Sending for multiple clients on SES?
We build owned email infrastructure with per-tenant deliverability hygiene baked in. Let's scope yours.
Book a Discovery Call