Amazon SES

Connect Amazon SES for high-volume, cost-effective email sending at scale. SES offers some of the lowest per-email pricing in the industry.

Prerequisites

• An AWS account
• SES out of sandbox mode
• A verified identity (domain or email address)
• An IAM access key with SES permissions
• A From address that can receive mail (GoodPostal emails a verification code to it; an alias or group works)

New to SES? The First-Time SES Setup section below walks through the AWS console from zero, including the DNS and production-access steps that trip people up.

Pricing: à la carte vs. SES pricing plans

SES offers two ways to pay. À la carte pricing charges $0.10 per 1,000 emails with no monthly fee. SES pricing plans (Essentials, Pro, and Enterprise) charge a higher per-email rate in exchange for bundled deliverability tooling. New SES accounts start on the Essentials plan at $0.16 per 1,000 emails.

For sending through GoodPostal, à la carte is the better deal at every volume. The plans mostly bundle Amazon's own deliverability dashboards, and GoodPostal already tracks deliveries, opens, clicks, bounces, and complaints for every campaign. Those event notifications flow through Amazon SNS, which meters separately; at newsletter volumes it is covered by SNS's free tier or costs a few cents a month.

To switch, open the Pricing plan page in the SES console and choose Cancel plan to return to à la carte pricing. If your account was placed on Essentials by default, the switch takes effect immediately. Plans are set per account and per AWS region, so make the change in the region you send from.

First-Time SES Setup (AWS Console)

Already have SES verified and out of sandbox? Skip to Setup Steps below. Otherwise, this is the full path through the AWS console, field-tested end to end.

Pick your region first. SES is region-specific: your domain identity, credentials, and everything GoodPostal auto-creates must live in one region. Check the region picker at the top right of the AWS console before doing anything. us-east-1 is a fine default.

1. 1

   Run the SES "Get set up" wizard

   Open Amazon SES > Get set up. The first step asks for your own email address and sends a verification link. This is account-owner verification only; it is unrelated to the addresses you will send from.
2. 2

   Add your sending domain

   Enter your root domain (e.g. yourdomain.org) so you can send as any address at it. Keep Use default MAIL FROM domain selected and leave the custom MAIL FROM field blank: DKIM handles DMARC alignment, and the default means zero changes to your existing SPF record. Keep Easy DKIM (2048-bit) enabled.
3. 3

   Select pricing plan

   Choose Cancel plan to switch to à la carte pricing (new accounts are placed on Essentials by default). Nothing GoodPostal needs is plan-gated; see the pricing section above.
4. 4

   Turn the deliverability enhancements off

   The wizard defaults these on; turn them all off. Engagement tracking is the critical one: SES open and click tracking rewrites your links and conflicts with GoodPostal's own tracking. Virtual Deliverability Manager duplicates analytics GoodPostal already provides, and Auto Validation bills per address while GoodPostal already suppresses bounces and complaints automatically.
5. 5

   Skip dedicated IPs and tenant management

   Leave the dedicated IP pool off (shared IPs are right for nearly all volumes) and leave tenant management blank. Review and finish.

Add the DKIM DNS records

The console now shows 3 CNAME records shaped like token._domainkey.yourdomain.org pointing at token.dkim.amazonses.com. Add them at your DNS host. SES re-checks automatically and the domain usually flips to Verified within minutes (up to 72 hours worst case).

These records coexist safely with DKIM records from other providers (Google, SendGrid, Salesforce, and the rest); the SES tokens are random and cannot collide. If the wizard suggests a DMARC record, add it only if your domain does not already have one.

Request production access

New SES accounts start in sandbox: 200 emails per day, verified recipients only. The Request production access button on the Account dashboard stays greyed out until your domain verifies, which is why DNS comes first. Once available, choose mail type Marketing (production accounts can still send transactional mail), enter your website, add any additional contacts who should see AWS's replies, and submit. Approval takes up to 24 hours and is often instant for AWS accounts with history. You can continue the rest of this guide while you wait; sandbox still delivers to verified addresses, so even the test email works.

Setup Steps

1. 1

   Create IAM credentials

   In the AWS IAM console, create a new user (no console access needed). Attach the AmazonSESFullAccess policy, and if you plan to use automatic setup, also attach AmazonSNSFullAccess: automatic setup creates an SNS topic and subscription in your account, which SES permissions alone do not allow. Then go to Security credentials > Create access key (use case: application running outside AWS). Copy the Access Key ID and Secret Access Key immediately, they will not be shown again. If you downloaded the .csv, delete it after pasting the values into GoodPostal.
2. 2

   Note your SES region

   SES is region-specific. Note which AWS region your verified identities are configured in (e.g., us-east-1, eu-west-1).
3. 3

   Add the provider in GoodPostal

   Go to Configure > Email Providers, click "Add Provider", select Amazon SES, and enter your Access Key ID, Secret Access Key, and Region.
4. 4

   Choose automatic or manual setup

   Unlike the other sending services, SES setup is manual by default, because automatic setup creates resources inside your own AWS account. Tick Set up Amazon SES automatically and GoodPostal creates the SNS topic, the SES List Management contact list, and the configuration set for you. Leave it unticked and you do that work yourself, starting with the SNS topic.
5. 5

   Paste your SNS Topic ARN (manual setup only)

   If you left automatic setup unticked, an SNS Topic ARN field appears and it is required before you can save. Create your SNS topic in AWS first (see Manual Webhook Setup below), then paste its ARN, which looks like arn:aws:sns:us-east-1:123456789012:goodpostal-bounces.
6. 6

   Test the connection

   GoodPostal will automatically test the credentials by querying the SES API. If the test fails, verify the IAM user has SES permissions and the region is correct.

Credentials

Access Key ID: AKIAIOSFODNN7EXAMPLE
Secret Access Key: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
Region: us-east-1

Sender Identity and the Test Email

With a domain identity verified, SES itself needs nothing more to send from any address at that domain. GoodPostal, however, verifies each sender identity separately: when you add a sender under Configure > Sender Identities, GoodPostal emails a verification code to the From address. The code expires after one hour, so the address must be able to receive mail before you create the sender; a free alias or group in Google Workspace or Microsoft 365 is enough.

Then send yourself a test email and check authentication. In Gmail, open the message menu and choose Show original: you want SPF PASS (the domain shown is amazonses.com, which is expected with the default MAIL FROM), DKIM PASS with your own domain, and DMARC PASS. All three green means the connection is fully configured.

Manual Webhook Setup

Skip this section if you ticked Set up Amazon SES automatically. GoodPostal already created and subscribed the topic for you.

SES uses Amazon SNS (Simple Notification Service) for delivery event notifications, so setting SES up by hand means creating an SNS topic and pointing your verified identity at it.

1. 1

   Create an SNS topic

   In the AWS SNS console, create a new Standard topic for SES delivery events. Create it in the same region as your SES verified identity. Copy its ARN into the SNS Topic ARN field in GoodPostal and save the connection.
2. 2

   Add an SNS subscription

   Once the connection is saved, the provider detail page shows an SNS Webhook Endpoint. Create an HTTPS subscription on your topic pointing at that URL. GoodPostal automatically confirms the SNS subscription request, as long as the ARN you saved matches the topic.
3. 3

   Point your identity at the topic

   In the SES console, open your verified identity, go to the Notifications tab, and set your new topic for Bounce and Complaint. Delivery is optional. Use this rather than a configuration set: GoodPostal does not stamp a configuration set on outbound mail when you set SES up manually, so a configuration set event destination receives nothing unless you also make it the default configuration set on the identity.

Recommended Events

• Bounce
• Complaint
• Delivery (optional)

Signature Verification

SES and SNS sign messages using X.509 certificates. GoodPostal automatically downloads and caches the signing certificate, then verifies each message's SHA1WithRSA signature. There is no webhook secret to set for SES.

What GoodPostal does need is the SNS Topic ARN saved on the provider. After the AWS signature passes, GoodPostal checks that the message came from the topic you bound to this connection, so a connection with no ARN saved rejects every event and cannot auto-confirm the subscription. Automatic setup creates the topic and stores its ARN for you.

Troubleshooting

• Domain stuck on Verification pending - The DKIM CNAME names are usually doubled (your DNS host auto-appended the domain; trim the name to end at ._domainkey), or a wildcard CNAME is masking the broken record. Check each with nslookup -type=CNAME.
• "Request production access" greyed out - The domain has not verified yet. Fix DNS first.
• Sandbox mode - SES starts in sandbox mode, which only allows sending to verified email addresses. Request production access through the AWS console to send to any recipient. If access is denied, reply inside the AWS support case with specifics: opt-in list source, expected volume, and that bounces, complaints, and unsubscribes are handled automatically through GoodPostal.
• Access denied - Check that the IAM user has the AmazonSESFullAccess policy attached
• Automatic setup partially fails - The IAM user is missing AmazonSNSFullAccess. Attach it, then click Re-run Amazon SES setup on the provider page.
• Sender verification code never arrives - The From address cannot receive mail. Create the mailbox or alias, wait a few minutes for it to propagate, then resend the code. Codes expire after one hour.
• Wrong region - Ensure the region configured in GoodPostal matches the region where your SES identities are verified

See also: Webhook Configuration Guide