Why SES (and when not)
| Pros | Cons |
|---|---|
| $0.10 per 1,000 emails (cheapest reliable option) | Sandbox-by-default; production mode is a request away |
| Solid deliverability with proper config | Per-region quota; cross-region orchestration needed for global scale |
| Native AWS — easy IAM + VPC + CloudWatch | Email-only; no built-in landing-page hosting like ConvertKit/Klaviyo |
| Dedicated IP option at $24.95/mo per IP | Initial 200/day sandbox cap is the slowest of all major ESPs |
Use SES if: large volume (>1M/mo), already on AWS, willing to do the sandbox-to-production workflow. Skip if: <50k/mo (Postmark's free tier is easier), or you need a managed all-in-one platform (Mailchimp/Klaviyo).
Setup overview — 4 phases
[AWS side] [AcelleMail side]
1. Verify domain (DNS records)
2. Request production mode
3. Add SES sending server
4. Test + go live
Total time: 1-2 hours active + 24h waiting for AWS production approval.
Phase 1: Verify your domain in AWS
Log into the AWS Console → SES (in your chosen region, e.g. us-east-1 / eu-west-1):
- Configuration → Verified identities → Create identity
- Choose Domain
- Enter your sending domain (e.g.
mail.example.com) - AWS shows DNS records: 3 CNAME records for DKIM + (optional) MX for Easy DKIM
- Add these CNAMEs at your DNS host
- AWS polls; once propagated (~5-30 min) status flips to Verified
Per AWS region. If you'll send from multiple regions, repeat in each region.
Phase 2: Request production mode
By default SES is in sandbox mode: only sends to verified addresses, 200 emails/day cap. Production mode = unlimited (within quota): any recipient, default 50k/day.
- SES → Account dashboard → Request production access
- Form: use case description, expected volume, complaint/bounce handling process
- AWS reviews in 24-48 hours
Be honest about volume + use case. AWS rejects requests that look like spam (e.g. "buy a list and send marketing without unsubscribe").
Phase 3: Add the server to AcelleMail
Open the sending-server detail
In AcelleMail's sidebar, click Sending → Sending servers. The list shows every server connected to this account with its status chip, sending limit, and last activity:
Click into the row you want to configure. The detail page surfaces Connection settings (host / credentials), Configuration (server name, default from, sending limit, bounce + FBL handler), and the Test connection / Send test email buttons in the toolbar:
For the SES setup specifically:
Pick the SES type
Type selector:
Choose either:
- Amazon SES (API) — uses SES SendEmail API (recommended; faster, better tracking)
- Amazon SES (SMTP) — uses SES SMTP relay (compatible with vendor-neutral setups)
Most installs pick API mode.
Fill the SES config
The Amazon SES (API) create form:
For SMTP-typed SES (the alternative integration), the form looks like:
Either way, the create form asks for:
| Field | Where to get it |
|---|---|
| AWS Access Key ID | IAM → Create user → AmazonSESFullAccess policy (or custom restricted) |
| AWS Secret Access Key | Generated alongside Access Key |
| AWS Region | The region you verified your domain in (e.g. us-east-1) |
| Default from email | An address on your verified domain |
Save. AcelleMail probes the credentials immediately — see Active badge or inline error.
Verify the SPF/DKIM/DMARC chips
After saving, the server detail page shows the auth status:
- SPF should be Green if your domain's SPF record includes
include:amazonses.com - DKIM should be Green if your AWS-side CNAME records are propagated (Phase 1 step 5)
- DMARC should be Green if your domain publishes a DMARC policy (separate from SES — set up at your DNS host)
If any chip is Red, click Verify domain in the toolbar for the DNS-fix wizard.
Phase 4: Test send + go live
Run the diagnostic from the toolbar:
Sends a real message via SES to whatever address you specify. Check your own inbox — message arrives within seconds. If sandbox-mode-still-pending, the test will fail with "Email address not verified."
After successful test, attach the SES server to your plan and launch a small campaign. Validate metrics in the campaign report:
Region pinning for global sends
If your audience is global, choose region(s) based on recipient locations:
| Audience region | SES region recommendation |
|---|---|
| US-heavy | us-east-1 (Virginia) — best AWS-global integration |
| EU-heavy | eu-west-1 (Ireland) or eu-central-1 (Frankfurt) — GDPR data residency |
| APAC-heavy | ap-southeast-1 (Singapore) or ap-northeast-1 (Tokyo) |
| Truly global | Multi-region setup — verify domain in 3 regions, add 3 sending servers in AcelleMail, route per recipient via custom logic |
Common UI signals + fixes
| Symptom | Likely cause | UI fix |
|---|---|---|
| New SES server status Testing indefinitely | Wrong region selected | Edit credentials → match the region where you verified your domain |
| Test send fails "Email address not verified" | SES still in sandbox mode | Request production mode at AWS → wait 24h |
| Production approved but still 200/day cap | Per-account quota; AWS raises gradually | Send daily at the cap for a week; AWS auto-raises if metrics clean |
| DKIM chip Red after 1 hour | DNS CNAMEs not propagated yet | Wait up to 24h; if still red, verify CNAMEs at your DNS host |
| Bounce rate high (5%+) on first day | SES is sensitive to bounce — auto-suspends accounts above 5% | Pause; clean list; resume slowly |
| Complaint rate >0.1% | SES auto-pauses accounts at 0.1% | Pause; audit consent + content; SES sends recovery instructions |
| All emails arrive but tracking shows opens at 0% | SES open tracking requires Configuration Set | Enable via AWS Console → Configuration → Configuration Sets |
Advanced: dedicated IP pool, Configuration Sets, and IAM least-privilege
Dedicated IP setup:
For >5M emails/month, dedicated IP gives full control over reputation:
- AWS SES → Dedicated IPs → Request new dedicated IP ($24.95/mo per IP)
- Wait ~1-2 days for provisioning
- AcelleMail-side: no config change needed; SES automatically routes your sends via the dedicated IP
For dedicated IP pools (multiple IPs for rotation), use SES Configuration Sets:
Configuration Set: "production-marketing"
Dedicated IP pool: [ip1, ip2, ip3]
Tracking: enabled (open + click)
CloudWatch destination: enabled
Configuration Set: "production-transactional"
Dedicated IP pool: [ip4]
Tracking: disabled (transactional doesn't need engagement tracking)
In AcelleMail, set the SES Configuration Set in the server's advanced config (admin-side only). Different campaigns automatically use different IP pools.
IAM least-privilege policy:
The default "AmazonSESFullAccess" policy is overkill. Restricted alternative:
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": [
"ses:SendEmail",
"ses:SendRawEmail",
"ses:GetSendQuota",
"ses:GetSendStatistics"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"ses:FromAddress": "noreply@example.com"
}
}
}]
}
Limits AcelleMail's IAM user to send-only operations from a specific from-address. If the credentials leak, the blast radius is contained.
CloudWatch + bounce/complaint webhooks:
AWS publishes bounces + complaints to SNS topics. Subscribe:
- SNS → Create topic "ses-bounces"
- SES → Configuration Sets → [your set] → Event destinations → Add SNS
- SNS → Subscriptions → Add HTTP endpoint pointing to AcelleMail's bounce webhook
AcelleMail receives bounce + complaint events in real-time, updates subscriber statuses immediately, removes hard-bounced addresses automatically.
SMTP vs API decision tree:
Want native bounce/complaint webhook from AWS? → API
Want minimum config, vendor-neutral? → SMTP
Sending from Wordpress / WHM / non-Acelle? → SMTP (works without AWS SDK)
High volume, want CloudWatch metrics? → API
Want to use Configuration Sets? → API
For AcelleMail specifically: API. The SDK gives full event-stream access; SMTP is more limited.
Multi-region orchestration:
If you've verified in us-east-1 + eu-west-1 + ap-southeast-1:
- Add 3 sending servers in AcelleMail, one per region
- Use subscriber tags to mark recipient region (
tag:us,tag:eu,tag:apac) - Create 3 Plans, each scoped to a single regional server
- Assign campaigns to the right plan based on segment
End result: US recipients send from us-east-1 (lowest latency to US ISPs), EU from eu-west-1 (GDPR data residency), APAC from ap-southeast-1.
Related articles
- Configuring multiple sending servers
- SES sending limits cookbook
- Sender reputation monitoring
- IP warmup schedule for new sending servers
7 bình luận