Collect these before submitting, and keep them: AWS may ask for any of them in a follow-up (see reply-templates.md). Put files
under evidence/ next to this file, named YYYY-MM-DD-<what>.<ext>. Never put secrets, access keys, tokens or full card numbers in any file. Redact
before saving.
The evidence/ folder is git-ignored: screenshots and mail headers contain addresses and account details, and they do not belong in the repository.
Keep text notes only in the repo; keep the files in that local folder or a private drive.
| # | Evidence | How to capture | Backs which gate |
|---|---|---|---|
| 1 | Site footer / contact page showing operator name, address and abuse contact | Full-page screenshot of https://vlozi.app footer and contact page, with the date visible |
R1 |
| 2 | Published policy pages | Screenshot of each URL returning 200 (Terms, Privacy, Acceptable Use, Anti-Spam, Abuse, Sub-processors) | R8 |
| 3 | DKIM and custom MAIL FROM status | SES console → identity → Authentication tab; or the aws sesv2 get-email-identity output from R3 (identity name only) |
R3 |
| 4 | DNS records | Output of Resolve-DnsName for bounce.vlozi.app MX and TXT, and _dmarc.vlozi.app |
R3 |
| 5 | Received-message headers | Gmail "Show original" for a real login code and invitation sent by SES: SPF, DKIM and DMARC all PASS (hide personal addresses) |
R3 |
| 6 | Rendered system emails | Screenshots of the login code, reset, invitation, welcome and billing notices | reply T4 |
| 7 | Role-address tests | The test mail received at abuse@ and postmaster@ (and the others in R4), with headers showing the date; the root address founder@vlozi.app receiving an outside mail |
R4, R2 |
| 8 | Simulator results | Comms logs showing provider: ses, and the ops "Email suppression" page, after inviting the SES simulator addresses |
R5 |
| 9 | SNS subscription confirmed, and the unsigned-POST test | SNS console → topic → subscription shows a real ARN and "Confirmed"; the curl.exe result from R5 |
R5 |
| 10 | CloudWatch alarms | Alarm list showing both SES reputation alarms in OK, with thresholds visible |
R9 |
| 11 | Sign-up with verification step | Screen recording or screenshots of register → emailed code → verified | reply T2 |
| 12 | Account standing | Billing payment method (digits hidden), root MFA enabled, Support plan | R2 |
| 13 | get-account output |
aws sesv2 get-account --region ap-south-1 before submission (sandbox) and after approval |
R5, case log |
| 14 | Guard and secrets | npx wrangler secret list for comms (names only, showing SES_TENANT_SENDING absent); a log line for a refused tenant send |
R6 |
| 15 | Abuse limits | The 429 responses from the sign-up, resend and invitation checks | R7 |
| 16 | The submitted text | The exact text pasted into the console, copied into the case log the same day | R10 |
| 17 | Every AWS reply | Verbatim, with the date, in the case log | R10 |
Rules
- Date everything.
- If a screenshot contradicts the case text, fix the text, not the screenshot.
- Re-capture anything older than two weeks if AWS has not yet answered.