Working with Amazon SES: Identities, Security, Reputation and Pricing

Amazon Simple Email Service (SES) is the sending infrastructure behind a great deal of transactional email: password resets, order confirmations, alerts and notifications. It is cheap, scalable and deliberately bare, which means the setup work of verifying identities, scoping credentials and monitoring reputation is yours to do. This guide covers what SES is used for, how identity verification works, the security setup for an SES account, and how pricing works. For the sandbox and quota mechanics, see our Amazon SES sandbox and sending quotas guide.

What you can do with Amazon SES #

• Transactional email: one-to-one messages triggered by user actions, where reliability matters most.
• Marketing email: newsletters and campaigns to subscribers who have opted in. SES provides the delivery layer; campaign management, templates and analytics dashboards come from tools you build or integrate.
• Application and system notifications: alerts and reports sent directly from your software.
• SMTP interface: connect existing applications with SMTP credentials and no code changes.
• API: send programmatically with support for attachments, templates and advanced options.
• Email receiving: accept inbound mail and route it to S3, Lambda or SNS for processing.
• DKIM signing: sign outbound mail so recipients can confirm it was not altered in transit.

Developers building SaaS products, e-commerce platforms and notification systems are the core audience; businesses moving from more expensive email providers use it for volume sending; agencies running email for several clients keep each client in the client’s own AWS account with separate sending domains, reputations and configuration sets.

Verifying identities #

Before SES will send from a domain or address, you must prove you control it.

• Domain verification means publishing DNS records that SES provides. With Easy DKIM, SES generates the DKIM tokens for you; with Bring Your Own DKIM (BYODKIM) you supply your own key pair. Domain verification is the recommended path and helps production access requests succeed.
• Email address verification sends a confirmation link to the address; it is verified when you follow the link.
• Timing: depending on your DNS provider, domain verification can take up to 72 hours to complete.

Once verified, add SPF and DMARC records too; our guide to SPF, DKIM and DMARC explains what each record does.

Securing an SES account #

1. Protect the AWS root user with a strong password and MFA, and do not use it for SES.
2. Create IAM users or roles for SES with permissions limited to what the application needs, typically ses:SendEmail and ses:SendRawEmail.
3. Generate SMTP credentials from IAM rather than reusing console credentials, and rotate them.
4. Set AWS Budgets alerts so a runaway sending loop is noticed quickly.
5. Monitor sending statistics and reputation metrics in the SES console for unusual activity.
6. Configure event destinations to receive bounce, complaint and delivery events, so you can react to deliverability problems within hours rather than weeks.

Management essentials #

• Sending quotas: sandbox accounts are limited to 200 messages per 24 hours and 1 message per second, and can only send to verified addresses. Production accounts start with higher quotas that grow with good sending behavior or through a support request.
• Reputation: keep bounce and complaint rates low. High rates trigger reviews and can pause sending.
• Configuration sets: group sending by purpose and apply consistent tracking, event destinations and IP pools.
• Suppression list: the account-level suppression list automatically prevents sending to addresses that hard-bounced or complained.
• Dedicated IPs: worthwhile only at volumes where you can keep the IP warm; most senders do better on the shared pool.

How Amazon SES pricing works #

SES is pay-as-you-go with no upfront fees or minimums. Figures below are as published at the time of writing; confirm current pricing on the official page.

Cost scenarios

• A developer sending 50,000 transactional emails per month pays roughly $5 in sending fees plus a small amount for data.
• A high-volume sender at 5 million emails per month with a standard dedicated IP pays roughly $500 in sending fees plus $24.95 for the IP plus data fees.

Keeping SES costs down

• Set AWS Budgets alerts and review Cost Explorer.
• Keep attachments small; data transfer is billed separately.
• Add dedicated IPs only when volume justifies them.
• Delete unused identities and configuration sets to keep the account tidy.

A first-week checklist #

1. Verify your sending domain with Easy DKIM and publish SPF and DMARC records.
2. Create an IAM user or role limited to ses:SendEmail and ses:SendRawEmail, and generate SMTP credentials from it if your application needs SMTP.
3. Create a configuration set with an event destination for bounces and complaints.
4. Send test mail to the mailbox simulator addresses to exercise bounce and complaint handling.
5. Request production access with a clear description of your sending and consent practices.
6. Set a budget alert and review sending statistics after the first week of live traffic.

Official references #

The Amazon SES documentation covers identities, the sandbox, quotas and pricing. Our Amazon SES platform overview summarizes the service and how to sign up officially.

Frequently asked questions #

Can I use my own domain with SES?

Yes. Verify the domain by publishing the DNS records SES provides, then send from any address at that domain with DKIM signing.

Can I send to any recipient?

Once the account has production access, yes. In the sandbox you can only send to verified addresses or the mailbox simulator. In both cases the From address must be a verified identity.

How do I manage SES?

Through the AWS Management Console, or the AWS CLI and SDKs for automation.