Set up Amazon SES, step by step

Before you start

1. Create an AWS account and pick your region

   Sign up at aws.amazon.com. Once in, turn on multi-factor sign-in for the root user (your account name at the top right, then Security credentials).

   Open the SES console by searching for Simple Email Service. In the region menu at the top right choose the region closest to your readers. For India that is Asia Pacific (Mumbai) ap-south-1.

   Everything in SES belongs to one region: identities, limits and production access. Do every step below in the same region.

2. Verify your domain with DKIM

   Go to Configuration → Identities → Create identity. Choose Domain and type your domain, for example yourbrand.com.

   • Tick Use a custom MAIL FROM domain now and type bounce (or do it in step 3).
   • Under Advanced DKIM settings keep Easy DKIM and RSA_2048_BIT, with DKIM signatures enabled.
   • Click Create identity. SES shows three CNAME records. Add each one in your DNS.

   Type	Name (host)	Value (points to)
   CNAME	abc123…._domainkey.yourbrand.com	abc123….dkim.amazonses.com
   CNAME	def456…._domainkey.yourbrand.com	def456….dkim.amazonses.com
   CNAME	ghi789…._domainkey.yourbrand.com	ghi789….dkim.amazonses.com

   Copy the exact values from your SES screen; the ones above are only the shape. SES checks DNS on its own and shows Verified, usually within minutes and at most 72 hours.

   Most DNS panels add your domain to the host name for you. If yours does, type only abc123…._domainkey. On Cloudflare, set these CNAMEs to DNS only (grey cloud).

3. Set a custom MAIL FROM domain (SPF)

   The MAIL FROM domain is where bounces go. Using your own subdomain makes SPF match your brand, which DMARC needs. Open your identity, then Custom MAIL FROM domain → Edit, enter bounce.yourbrand.com, and keep Use default MAIL FROM domain as the fallback. Add these two records:

   Type	Name (host)	Value	Priority
   MX	bounce.yourbrand.com	feedback-smtp.ap-south-1.amazonses.com	10
   TXT	bounce.yourbrand.com	"v=spf1 include:amazonses.com ~all"	–

   Change ap-south-1 if you chose another region. Your main domain's own SPF record does not change, because this one sits on the subdomain.

4. Add a DMARC record

   DMARC tells Gmail, Yahoo and Outlook what to do with mail that fails DKIM and SPF. Gmail and Yahoo expect bulk senders to have one. Start in monitoring mode:

   Type	Name (host)	Value
   TXT	_dmarc.yourbrand.com	"v=DMARC1; p=none; rua=mailto:[email protected]"

   If a DMARC record already exists, keep it; there must be only one. After a few weeks of clean reports, move to p=quarantine, and later p=reject.

5. Test while still in the sandbox

   New accounts start in the sandbox: you can send only to addresses you have verified, up to 200 emails in 24 hours and one per second. Add your own Gmail and Outlook addresses under Identities → Create identity → Email address, click the links Amazon emails you, then use Send test email on your domain identity.

   In Gmail open the test, choose ⋮ → Show original and check that SPF, DKIM and DMARC all say PASS.

6. Request production access

   Go to Account dashboard → Request production access and fill in:

   • Mail type: Marketing (or Transactional if you only send welcome and account emails).
   • Website URL: your live website.
   • Additional contacts: up to four email addresses for AWS notices.
   • Preferred contact language and the acknowledgement of the AWS policies.

   Amazon may write back asking how you will use SES. A clear, honest answer gets approved fastest. You can adapt this:

   We send marketing and follow-up emails to people who enquired on
   yourbrand.com or our advertisements and gave their email address.
   Each enquiry records the date and source of consent.
   
   - Expected volume: about 50,000 emails a month, growing gradually.
   - Every email has a one-click unsubscribe header and a footer link;
     unsubscribes are honoured immediately.
   - Bounces and complaints are received through SES event notifications;
     hard-bounced and complaining addresses are suppressed automatically.
   - Lists are cleaned before import (typos, duplicates, role and
     disposable addresses removed). We never buy or rent lists.
   - Sending domain is authenticated with DKIM, SPF (custom MAIL FROM)
     and DMARC.

   Approval typically comes within a day or two. Once approved, the dashboard shows your daily quota and sending rate. They rise as you send good mail; ask for more under Service Quotas when you need it.

7. Create a sending key that can only send

   Never use the root account's keys. Open IAM, then Users → Create user, name it cortex-mail, choose Attach policies directly → Create policy → JSON and paste:

   {
     "Version": "2012-10-17",
     "Statement": [{
       "Effect": "Allow",
       "Action": [
         "ses:SendEmail",
         "ses:SendRawEmail",
         "ses:GetAccount",
         "ses:GetEmailIdentity",
         "ses:ListEmailIdentities"
       ],
       "Resource": "*"
     }]
   }

   Save the policy, attach it to the user, then open the user's Security credentials → Create access key and choose Application running outside AWS. Copy the Access key ID and Secret access key; the secret is shown only once.

   Paste the key only into the sending settings of your email tool. Do not email it, share it on WhatsApp or put it in a document. If it ever leaks, deactivate it in IAM and create a new one.

8. Connect it to Cortex Mail

   In your Cortex Mail workspace, open Settings → Sending → Your own Amazon SES, choose the region, and paste the access key ID and secret. Cortex Mail checks the key, lists your verified domains, and sets up bounce and complaint tracking for you. Amazon bills you for the emails; Cortex Mail never marks them up.

   Cortex Mail is in early access. Request a place and we will do this step with you.