Amazon SES

Amazon SES is inexpensive and reliable, and it is also the provider that reacts fastest to bounces. This page covers connecting it and keeping it out of trouble. SubsiMail connects to SES over ordinary SMTP with the SMTP credentials SES gives you (see Connect via SMTP/IMAP).

Set-up checklist

  1. Verify your domain in SES and publish the three DKIM records; add SPF and DMARC (see Deliverability).
  2. Request production access. Until it is granted, SES only sends to verified addresses. Describe your list source, volume and how you handle bounces honestly; requests that describe scraped lists are often refused.
  3. Create SMTP credentials (an IAM user limited to sending) and connect the mailbox in SubsiMail with host email-smtp.<region>.amazonaws.com, port 465 or 587.
  4. Set up the bounce feed below before your first campaign.

SES can send as any address on a verified domain, but it has no inbox. To read replies, connect a real mailbox with IMAP and point the campaign's Reply-To at it.

Amazon's limits

Amazon publishes its guidance: an account is reviewed at roughly a 5% bounce rate or 0.1% complaint rate, and sending can be paused at about 10% bounces or 0.5% complaints. These can change, and Amazon can act sooner on a brand-new account or a sudden spike. SubsiMail's own limits (pause at 2%, mailbox stop at 4%) sit well inside them on purpose.

The bounce feed

SES doesn't email you its bounces. Send them to SubsiMail through Amazon SNS:

  1. In SubsiMail open Settings → Bounce & complaint feed (admins only) and copy your private endpoint.
  2. In the AWS console: SNS → Topics → Create topic (Standard), in the same region as SES.
  3. Open the topic → Create subscription, protocol HTTPS, endpoint = the address you copied. SubsiMail confirms it automatically.
  4. SES → Verified identities → your domain → Notifications: set Bounce and Complaint feedback to that topic.

The same page then shows when the last notification arrived and how many bounces and complaints were recorded in the last 7 days.

The endpoint must be reachable from the internet over HTTPS, and its address is a secret — anyone who knows it could send fake bounces. If SubsiMail runs on a home network or behind a firewall, use the inbox method instead (see Bounce protection).

If SES pauses or shuts down your account

Emails then fail with 554 Message rejected: Sending paused for this account. SubsiMail recognises this: the mailbox pauses instead of writing your contacts off as bounced, and the campaign page and the banner on every page show Amazon's message and what it means. To recover:

  1. Read the email Amazon sent to your AWS account address, and open SES → Account dashboard to see the reputation numbers.
  2. Stop sending. Clean your lists (run them through an email verifier) and remove the addresses that bounced.
  3. Reply to Amazon with a specific plan: what caused the bounces, what you changed, and how you will send from now on (small volumes, verified lists, bounce handling in place).
  4. Only when sending is re-enabled, resume slowly.

There is no guarantee Amazon will restore an account. Prevention — verified lists, a slow start, the bounce feed — is far cheaper than recovery.

Back Bounce protection Next Connect Gmail