How to Send and Receive Email With Amazon SES (and Get Your SMTP Details)

Amazon SES is one of the cheapest ways to send email from your own domain, and it can receive mail too. This guide takes you from a new AWS account to working SMTP details you can paste into any app, plus a rule that catches incoming mail.

I’ve used SES for years to send newsletters and website mail. It’s brilliant at what it does, but it’s a building block, not an email service with an inbox. If you want the bigger picture first, read my Amazon SES review. If you just want it working, start here.

What You Need Before You Start

What SES Can and Can’t Do

What It Costs

Prices as listed on AWS’s SES pricing page on 2 November 2026, in US dollars.

How to Send Email With Amazon SES

Sign in to the AWS console, search for Amazon Simple Email Service and choose a region from the menu at the top right. Your domain, SMTP details, sending limits and receipt rules all belong to that one region.

Pick a region that offers both SMTP and receiving. Europe (Ireland) eu-west-1, Europe (London) eu-west-2, Europe (Frankfurt) eu-central-1, US East (N. Virginia) us-east-1 and US West (Oregon) us-west-2 all do. I use London in the examples below. My screenshots are from Ireland, which looks exactly the same.

In the SES menu go to Configuration > Identities > Create identity. Choose Domain and type your domain, such as example.com.

• Under Use a custom MAIL FROM domain, tick the box and enter a subdomain you don’t use for anything else, such as bounce.example.com. This makes SPF line up with your domain as well as DKIM.
• Under Verifying your domain, open Advanced DKIM settings and leave Easy DKIM selected with RSA_2048_BIT keys and DKIM signatures enabled.
• If your DNS is on Route 53, leave Publish DNS records to Route53 ticked and SES adds the records for you.

Select Create identity.

Open the new identity and scroll to Publish DNS records. Copy each record into your DNS. You’ll have six:

If your DNS is on Cloudflare, my guide to setting up Cloudflare’s free DMARC monitoring sorts out the DMARC record and shows you every service sending as your domain, including SES.

SES checks your DNS on its own. The identity’s status changes from Pending to Verified, usually within minutes, though AWS says spotting the DKIM records can take up to 72 hours. The DKIM and MAIL FROM sections should each say Successful.

Every new SES account starts in the sandbox, separately in each region. In the sandbox you can only send to addresses and domains you’ve verified, up to 200 emails a day and one a second.

Go to Account dashboard and select Request production access. Choose Transactional or Marketing, add your website and describe in plain words what you’ll send and how people sign up. Confirm that you only email people who asked and that you handle bounces and complaints. AWS says it usually replies within 24 hours.

In the SES menu go to SMTP settings. Under Choose credential method you get two options:

• Mail Manager SMTP is marked Recommended, but it runs through Mail Manager, which has its own charges on top. Skip it unless you want Mail Manager’s extras.
• IAM SMTP credentials is the plain, cheap option. Choose this one, then select Create IAM credentials.

• AWS opens IAM in a new tab and suggests a user name starting ses-smtp-user. followed by the date. Keep it or type a clearer one, such as the app’s name, then select Create user.
• Select Show under SMTP password, then Download .csv file.

Every app asks for the same handful of settings. The server name is email-smtp. followed by your region and .amazonaws.com:

Example: send from your own domain in Gmail. In Gmail on a computer, go to Settings > See all settings > Accounts and Import > Send mail as > Add another email address. Enter your name and you@example.com, then on the next screen enter the SES server, port 587, your SMTP user name and password, and choose Secured connection using TLS. Gmail emails a code to that address, so you’ll need receiving working, or another inbox for that address, to finish.

How to Receive Email With Amazon SES

Mail finds its way to SES through an MX record. Add this to the domain or subdomain you want SES to receive for:

Type:      MX
Name:      in.example.com     (or example.com if nothing else receives mail there)
Priority:  10
Value:     inbound-smtp.eu-west-2.amazonaws.com

The domain (or its parent) must already be verified in the same region as the MX record points to.

In the SES menu go to Configuration > Email receiving > Create rule set, give it a name, then open it and select Create rule.

• Rule settings: give it a name and leave Spam and virus scanning ticked.
• Recipient conditions: add the addresses or domain the rule covers, such as in.example.com or hello@in.example.com. Leave it empty to catch everything for your verified domains.
• Actions: choose Deliver to Amazon S3 bucket. Select Create S3 bucket to make one with the right permissions, and optionally set a folder prefix such as inbox/.

Review and select Create rule. Then, back in the rule set list, make sure your rule set is the Active one. Only one rule set can be active at a time.

Each email lands in your bucket as one file with a long random name. Open the S3 console, find the bucket, select the newest file and choose Download. Rename it to end in .eml and it opens in Apple Mail, Outlook or Thunderbird as a normal email.

That’s fine for a handful of messages, like the confirmation code from Gmail in step 7. For day-to-day mail, add a Lambda forwarder or receive with a proper mailbox instead.

What to Consider

• It’s infrastructure, not a mail service. No inbox, no spam folder, no support line on the basic plan. You’re the email administrator.
• Look after bounces and complaints. AWS watches your bounce and complaint rates and can pause sending if they climb. Set up notifications under your identity’s Notifications tab, and remove addresses that bounce.
• Treat SMTP details like a password. Anyone with them can send as your domain. Give each app its own SMTP user, so you can delete one without breaking the rest.
• Protect the AWS account itself. Use a passkey or security key on the root user, and set an AWS budget alert so a leaked key can’t quietly run up a bill.
• Everything is per region. Identities, SMTP details, the sandbox and receipt rules. If you change region, you start again.
• Received mail is stored as-is. It isn’t encrypted end to end. You can turn on KMS encryption for the S3 action, and you should set an S3 lifecycle rule to delete old mail you don’t need.
• Blocking spam costs less earlier. Mail refused by an IP address filter isn’t charged. Mail processed by receipt rules is.

How to Test It

1. Send a test from the console. Open your identity and select Send test email. Pick a simulator scenario for a successful delivery, which sends to Amazon’s test address and works even in the sandbox, or Custom to send to an address you’ve verified (in the sandbox) or anyone (in production).

2. Send a test over SMTP. Send from your app or Gmail “Send mail as” to a Gmail address you own. Open it, select the three dots next to Reply, then Show original. You want to see:

SPF:   PASS with IP 54.240.x.x
DKIM:  'PASS' with domain example.com
DMARC: 'PASS'

If DKIM shows amazonses.com rather than your domain, your DKIM records haven’t verified yet.

3. Test receiving. From another account, email an address covered by your rule, such as test@in.example.com. Within a minute a new file should appear in your S3 bucket. If the sender gets a bounce instead, check the MX record, the region and that your rule set is active.

Alternatives to Amazon SES

Frequently Asked Questions

What are the Amazon SES SMTP settings?

The server is email-smtp.region.amazonaws.com, for example email-smtp.eu-west-2.amazonaws.com for London. Use port 587 with STARTTLS or 465 with SSL/TLS, and the SMTP user name and password you create under SMTP settings in the SES console.

Can I use my AWS password or access key as the SMTP password?

No. SES needs its own SMTP password. Create one under SMTP settings > IAM SMTP credentials > Create IAM credentials.

Can I read SES mail in Outlook or Apple Mail?

Not directly. SES has no IMAP or POP3. You can open saved .eml files, forward mail with a Lambda function, or use a mailbox provider for receiving.

How long does it take to get out of the sandbox?

AWS says it usually responds to production access requests within 24 hours. You need to ask separately for each region you send from.

Is Amazon SES free?

No, but it’s cheap. Sending is $0.10 per 1,000 emails on à la carte pricing, and receiving is $0.10 per 1,000 plus a small charge for large messages. New AWS customers may get Free Tier credits that cover early use.

Can I send as any address at my domain?

Yes. Once the domain is verified, any address at it can be the From address, such as hello@ or invoices@.

The Bottom Line

Sending with SES is well worth the hour it takes. You verify your domain once, create SMTP details, and every app, website and newsletter tool you own can send properly signed mail for a fraction of a penny each. Receiving works too, but it lands in storage rather than an inbox, so it suits automated addresses and developers more than personal mail. For most people, the sweet spot is SES for sending and a real mailbox for reading.

Sources: Amazon SES pricing, SES endpoints and quotas, obtaining SES SMTP credentials, connecting to an SES SMTP endpoint, SES email receiving concepts, publishing an MX record for SES.

Disclosure: This article contains an affiliate link to Fastmail. If you sign up through it, I may earn a commission at no extra cost to you. Checked against AWS’s documentation and pricing on 2 November 2026. AWS changes its console often, so labels may move.