How Do I Get Started With AWS SES?

Updated

Getting started with AWS SES means four things in order: verify a domain you control, publish SPF, DKIM, and DMARC records for it, request production access to leave the sandbox, then send and gradually scale real mail. Since early 2024, AWS requires a domain with SPF, DMARC, and DKIM in place before it will move you out of the sandbox, so domain setup is not optional preparation — it is the gate to production.

Step 1: Verify a sending domain

You need a domain you can edit DNS for. A subdomain dedicated to sending (for example mail.example.com) keeps your sending reputation separate from your main domain.

  1. Add the domain as an identity in SES.
  2. SES gives you DNS records to publish — typically a TXT record for domain verification and CNAME records for DKIM.
  3. Add those records at your DNS provider and wait for propagation.
  4. Confirm the identity shows as verified in SES.

Expected result: SES accepts the domain as a verified identity and will let you send from addresses at that domain.

Common blocker: verification stalls because records were added to the wrong zone or with the wrong name. Check the exact record names SES issued rather than guessing.

Step 2: Publish SPF, DKIM, and DMARC

These three records are what let receiving mail servers trust your mail, and they are now a precondition for production access.

Record Purpose What it does for you
SPF Lists which servers may send for your domain Stops spoofing and supports deliverability
DKIM Cryptographically signs your messages Proves the mail really came from you and was not altered
DMARC Tells receivers what to do when SPF/DKIM fail Aligns policy with your domain and gives you reporting

Set DMARC to a monitoring policy first, review reports, then tighten it. Jumping straight to a strict reject policy before you know all legitimate senders can break mail you did not know about.

Step 3: Request production access (leave the sandbox)

New SES accounts start in the sandbox, which restricts who you can send to. Moving out requires the domain setup above to already be in place.

  1. Confirm the domain is verified and SPF, DKIM, and DMARC are live.
  2. Submit the production access request describing what you send, to whom, and how you handle bounces and complaints.
  3. Wait for AWS to review and approve.

Expected result: your account can send to arbitrary recipients instead of only verified ones.

Common blocker: requests get rejected or delayed when the use case is vague or when the domain records are missing. Describe a concrete sending pattern and show you have a plan for bounces and complaints.

Step 4: Understand the pricing tier you are starting on

SES has a free tier, but it is smaller than it used to be. The free tier was 62,000 emails per month and was reduced to 3,000 emails per month as of August 2023. Beyond the free tier, SES bills per email sent and per gigabyte of attachments. Check the current pricing page before you size your sending, because the numbers above are historical and the free tier is the part most likely to change.

Practical consequence: if you send more than 3,000 emails a month, budget for per-email costs from day one rather than assuming the old free tier.

Step 5: Send your first transactional email

Transactional emails are the ones customers expect — signups and password resets are the classic examples. Start here because these recipients already expect your mail, which makes them the safest first sends.

  1. Send to your own address first and confirm delivery.
  2. Check the message headers to confirm SPF and DKIM pass.
  3. Verify your bounce and complaint handling is wired up before you send at volume.

Expected result: a delivered message with passing authentication, and a working feedback loop for bounces.

Step 6: Warm up the account before scaling

Warming up means sending small batches first, then ramping volume over time, and sending those early batches to known recipients who are likely to open or reply. The goal is to build a positive sending reputation so future mail lands in inboxes instead of spam folders.

A workable pattern:

  • Start with a small daily volume to your most engaged recipients.
  • Increase volume gradually over days or weeks, not hours.
  • Watch bounce and complaint rates and pause the ramp if they rise.
  • Only introduce colder or less engaged segments once the warm segments are stable.

Where to go next

Once the basics work, the two directions that matter most are transactional and marketing sending, because they have different expectations and different risk profiles. Transactional mail tolerates higher volume with lower engagement; marketing mail depends heavily on list quality and engagement. Treat them as separate sending streams with separate reputations where you can.

If you want a starting point for templates, SENDUNE (formerly Send With SES) is an open-source email platform for AWS SES built around an HTML email editor and no-code designer, so you can design and save templates and then send them manually or through the API.