AWS SES could not send the email, got 550 error - amazon-web-services

Question

I use SES for sending emails to users. Sometimes users reported to me that they did not receive any emails from me. I started to collect bounced emails via sns topic and found a lot of errors with status = 5.5.1 and
diagnosticCode
"smtp; 550 5.1.1 Remote MTA does not support STARTTLS. Message can be delivered only over a TLS connection."
I use the aws-sdk and my code which sends emais:
let params = {
Destination: {
ToAddresses: [emailDestination]
},
Message: {
Body: {
Html: {
Charset: "UTF-8",
Data: template({
...templateData
})
},
},
Subject: {
Charset: 'UTF-8',
Data: templateData.subject
}
},
Source: SOURCE_EMAIL,
ConfigurationSetName: CONFIGURATION_SET_NAME
};
await ses.sendEmail(params).promise()
My ConfigurationSet has TLS Required
What did I do wrong and could it be a remote configuration issue of the user?

Answer 1

I think you are on the right track of it being a remote issue. From the sound of the error, Amazon SES is trying to connect to a remote mail relay but failing to create a TLS connection and canceling instead.
Your configuration set is enforcing a policy of sending only when a TLS connection can be established to receiving server (and message is encrypted) all the way to the end-user. Depending on how sensitive your emails are, this may be the desired behavior.
However, if you want to continue to send the mail, even when unencrypted, you can disable the require TLS setting. Amazon will still use TLS when possible, according to their documentation -
https://docs.aws.amazon.com/ses/latest/DeveloperGuide/security.html
By default, Amazon SES uses opportunistic TLS. This means that Amazon SES always attempts to make a secure connection to the receiving mail server. If Amazon SES can't establish a secure connection, it sends the message unencrypted.