.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
How Amazon SES puts PHI at risk
A technical analysis of failures in TLS version, certificate, and plaintext behavior in Amazon's transactional email service.
Download Free Report
REPORT
2025 healthcare email security report
Key insights from 180 email-related healthcare breaches and actionable steps to protect your organization.
REPORT
2025 healthcare email security report
Key insights from 180 email-related healthcare breaches and actionable steps to protect your organization.
Top takeaways
How Amazon SES puts PHI at risk documents what Amazon Simple Email Service does with healthcare email across fourteen controlled tests. The Require TLS setting closes one failure mode and leaves the rest open.
14 controlled tests run against Amazon SES sending infrastructure, each captured with the recipient-side Received header as evidence.
4 invalid certificate tests Amazon SES delivered in full. None were blocke under either configuration.
IETF retired TLS 1.0 and 1.1 in 2021. Amazon SES still delivers healthcare email over both protocols.
3 of 4 failure modes still pass through with Require TLS enabled. Only the no-encryption case bounces.
Key resources
