Since updating to 2026.1.5, I now see this site advice:
The server is configured to send emails via Amazon SES but you haven’t allowlisted any SNS topic ARNs. Bounce notifications will be rejected until you add the legitimate ARN to aws_sns_topic_arn_allowlist.
I can’t find any information about this setting though.
I found this in the 2026.1.5 changelog, but it doesn’t really explain what to do: SECURITY: Prevent any signed AWS SNS TopicARN from being accepted via… · discourse/discourse@3a3d315 · GitHub