AWS Cognito用户池确认码未送达法国部分邮箱求助
I’ve helped several clients resolve exactly this issue with French ISPs blocking Cognito’s verification emails—most cases boil down to email deliverability reputation, misconfigured SPF/DKIM, or ISP-specific anti-spam rules. Here’s a step-by-step breakdown of what to check and fix:
1. Switch Cognito to Use a Custom SES Domain
By default, Cognito sends emails from AWS’s generic domains (like no-reply@verificationemail.com), which many French ISPs flag as high-risk. Here’s how to switch to your own domain:
- First, verify your custom domain in Amazon SES, and properly configure SPF, DKIM, and DMARC DNS records to boost your domain’s email reputation.
- In your Cognito User Pool settings, navigate to Message customizations and update the
From email addressto a verified address from your SES domain (e.g.,no-reply@yourbrand.fr). - Make sure your SES domain is set to Production Access—sandbox mode only allows sending to verified test emails, which won’t work for real users.
2. Audit SES Deliverability Metrics
Head to the SES Dashboard and check these critical stats to spot red flags:
- Bounce Rate: If this exceeds 1%, AWS will throttle your sending capacity, and French ISPs will outright reject emails from low-reputation domains.
- Complaint Rate: If users mark your emails as spam, this tanks your reputation fast.
- Enable Email Feedback Forwarding to receive bounce/complaint notifications—these will help you identify specific issues (like invalid user emails or content triggers).
3. Optimize Email Content for French ISP Rules
FreeTelecom and Orange have strict anti-spam filters that target vague or "spammy" content. Tweak your Cognito verification email template:
- Use a clear, French-language subject line like
Votre code de vérification pour [Nom de votre service]—avoid generic or overly urgent phrasing. - Open the email with a direct, polite message in French:
Bonjour, voici votre code de vérification pour activer votre compte sur [Nom de votre service]. - Skip excessive capitalization, exclamation points, or words like "urgent" that trigger spam filters.
- Include your service name and contact information at the bottom to add legitimacy.
4. Guide Users to Check Spam Folders and Whitelist Your Domain
Sometimes emails aren’t blocked—they’re just misfiled:
- Advise users to check their spam/advertisement folders (Orange calls this the "Courriers indésirables" folder, FreeTelecom uses "Spam").
- Tell users to add your sending domain (e.g.,
yourbrand.fr) to their email whitelist or safe sender list. For Orange users, this is the "Liste sécurisée" feature.
5. Escalate to AWS Support and ISP Teams
If all else fails:
- Reach out to AWS Support with specific email IDs (you can find these in Cognito’s user event logs or SES’s delivery logs). They can trace whether the email reached the ISP’s server and why it was rejected.
- Contact FreeTelecom and Orange’s technical support teams directly. Share your sending domain, a sample verification email, and explain the issue—ask them to whitelist your domain in their systems.
内容的提问来源于stack exchange，提问作者Benjamin B
