How to Set Up Amazon SES for Email Marketing: The Complete 2026 Setup Guide

The Cheapest Email Sender on the Internet Has One Problem — and a 30-Minute Fix

Amazon SES (Simple Email Service) is the cheapest, most reliable way to send marketing email at scale. $0.10 per 1,000 emails. 99.9% uptime SLA. Twelve global regions. Trusted IPs. So why does almost no marketer actually use it?

One word: console. The AWS console is built for engineers, not lifecycle marketers. Identity verification, DKIM signing, sandbox exits, sending limits, IAM policies — the SES setup wall is real, and it’s the entire reason SaaS resellers like SendGrid and Mailgun mark up SES by 30× and stay in business.

This guide takes you from zero AWS knowledge to a verified, warming, production-ready Amazon SES email marketing setup in under 30 minutes — with every gotcha called out.

What you’ll have at the end: A verified domain, DKIM-signed sending, an IAM user with SES SMTP credentials, sandbox exit submitted, and a 30-day IP warmup plan ready to execute.

Step 1: Pick Your AWS Region (Don’t Skip This)

SES runs in 12+ regions, but for marketing email three matter most:

Common mistake

Picking us-west-2 “because it’s cheaper.” It’s not cheaper for SES, and you’ll burn 2 weeks of warmup if you migrate later.

Step 2: Verify Your Sending Domain (Not Just an Email)

You can verify a single email address in SES, but agencies should always verify the full sending domain. Domain verification unlocks DKIM, allows wildcard sending (any@yourdomain.com), and is required for DMARC alignment.

1. Open the SES console → Verified identities → Create identity.
2. Choose Domain, enter yourbrand.com.
3. Toggle on Easy DKIM with RSA-2048 (the 2026 default).
4. SES generates 3 CNAME records. Copy them into your DNS host (Cloudflare, Route 53, etc.).
5. Wait 5–15 minutes. Verification status flips to Verified.

DNS records you’ll add

• 3 DKIM CNAMEs — SES-generated, unique per identity.
• SPF TXT — v=spf1 include:amazonses.com ~all (or include alongside existing records).
• DMARC TXT — start with v=DMARC1; p=none; rua=mailto:dmarc@yourbrand.com, tighten later.
• MX — only if SES will receive (most marketers skip this).

Step 3: Create the IAM User and SMTP Credentials

Never — never — use root AWS credentials. Create a dedicated IAM user with the minimum permissions to send via SES.

Minimum IAM policy for SES sending

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ses:SendEmail",
        "ses:SendRawEmail",
        "ses:GetSendQuota",
        "ses:GetSendStatistics"
      ],
      "Resource": "*"
    }
  ]
}

Then in SES → SMTP settings → Create SMTP credentials. AWS converts your IAM secret into an SMTP password — this is the only credential you paste into EmailSendX or your sender of choice.

Step 4: Get Out of the Sandbox

Every new SES account starts in the SES sandbox: 200 emails/day, only to verified addresses. To send marketing, you have to request production access.

How to write the sandbox exit request that actually gets approved

AWS support reviews these by hand. The form fields that matter:

• Use case description: Be specific. “We send transactional and lifecycle email to opted-in customers of [your domain]. List sources are double-opt-in newsletter signups and post-purchase receipts. Bounce and complaint rates are monitored via SNS, with auto-suppression on hard bounce and complaints.”
• Expected daily volume: Honest, but realistic. If you’ll send 50k/day, ask for 100k.
• Bounce/complaint handling: “SNS topic configured. Hard bounces auto-added to suppression. Complaints removed and logged for compliance.”
• Unsubscribe process: “Every email contains a one-click unsubscribe link (RFC 8058 compliant).”

Approval typically arrives in 24–48 hours. Vague applications get rejected.

Step 5: Configure SNS for Bounce + Complaint Tracking

SES doesn’t store events — it fires them to SNS topics. You need this to detect hard bounces, soft bounces, complaints, and (optionally) opens and clicks.

1. Create an SNS topic: ses-events-yourbrand.
2. In SES → Configuration sets → create marketing-default.
3. Add an event destination → SNS → subscribe to bounce, complaint, delivery, send.
4. Wire your sending platform’s webhook receiver to that SNS topic.

Why this matters

Without bounce + complaint feedback, your reputation will collapse in 3–5 sends. SES will then throttle you back to 1 email/second and the warmup is dead.

Step 6: Plan Your IP Warmup

SES gives you shared IP pool by default. For marketing volume above 100k/month, request a dedicated IP ($24.95/mo each) and warm it over 30 days.

Step 7: Connect SES to Your Marketing Platform

SES is the engine. You still need a control plane — somewhere to design templates, manage contacts, run automations, and view analytics. The cheapest path:

1. Sign up for a flat-fee marketing platform that supports BYOS (bring-your-own-SES).
2. Paste your SES SMTP credentials.
3. Verify domains in the platform (most pull from SES automatically).
4. Send.

EmailSendX is built specifically for this. Paste your SES IAM key, the platform validates the connection in under 5 seconds, pulls your verified identities, and you’re ready to ship campaigns. Eight providers are supported with auto-failover — if your SES throttles, sends route to SendGrid or Postmark mid-campaign.

Common SES Setup Mistakes (and How to Avoid Them)

1. Forgetting DMARC. SPF and DKIM alone don’t protect your domain — DMARC tells receivers what to do when alignment fails.
2. Sending from a free domain. Gmail and Outlook deliverability requires a paid, branded sending domain.
3. Skipping the bounce webhook. Without auto-suppression, your reputation tanks in week one.
4. Using the same IP for transactional and marketing. Separate them with configuration sets and tags.
5. Cold-sending to a 3-year-old list. Re-engagement first; cold sending nukes brand-new IPs.

How EmailSendX Makes SES Setup Painless

The biggest reason marketers skip SES isn’t cost — it’s the AWS console. EmailSendX wraps the entire SES experience in a friendlier control plane:

• SPF / DKIM / DMARC wizard — tells you exactly which DNS records are missing.
• Verified identity sync — pulls your SES domains and email addresses automatically.
• Bounce + complaint feedback baked in — SNS-style webhooks pre-wired.
• Reputation dashboard — bounce, complaint, delivery rates updated in real time.
• Provider failover — if SES throttles or your reputation dips, sends route to a backup provider mid-campaign.

FAQ: Amazon SES for Email Marketing

Is Amazon SES good for email marketing or only transactional?

Both. SES is provider-agnostic — it doesn’t know if your email is a receipt or a newsletter. With proper warmup, configuration sets, and bounce handling, SES is excellent for marketing volume of any size.

How long does it take to get out of the SES sandbox?

Usually 24–48 hours. The faster route is a specific use-case description, honest volume estimate, and clear bounce/complaint handling plan.

How much does Amazon SES cost in 2026?

$0.10 per 1,000 emails for outgoing email plus $0.12 per GB of attachments. Dedicated IPs are $24.95/mo each.

Do I need a marketing platform on top of SES?

For marketing email at any scale, yes — you need a way to manage contacts, design templates, run automations, A/B test, track engagement, and handle unsubscribes. SES is the engine, not the dashboard.

Can I use Amazon SES with multiple clients/brands?

Yes. Verify each client’s domain as a separate identity. Use configuration sets to track per-client metrics. Or run each client through its own SES account — EmailSendX supports both via multi-workspace.