Send your first email through AWS SES in 4 minutes
Amazon Simple Email Service (SES) is the cheapest way to send bulk email at scale — $0.10 per 1,000 emails. Mailchimp charges $1,200/month for 280k subscribers. SES charges $28. This guide walks you through it end-to-end in four steps.
Sandbox vs. production — what actually changes
| Limit | Sandbox | Production |
|---|---|---|
| Recipient restriction | Verified addresses only | Anyone |
| Daily send quota | 200 emails/day | 50,000+ emails/day |
| Send rate | 1 email/second | 14 emails/second (default) |
| Bounce/complaint tracking | Limited | Full SNS notifications |
| Configuration sets | Available | Available |
| Dedicated IPs | Not available | Available ($24.95/mo each) |
Step 1: Create an AWS account
Go to aws.amazon.com and click Create an AWS Account. You need a credit card on file. AWS will charge a $1 verification hold that is refunded immediately. Set up MFA on your root account before doing anything else — this is non-negotiable for a production sending environment.
Step 2: Choose your region
| Region | Code | Best for |
|---|---|---|
| US East (N. Virginia) | us-east-1 | US audiences, most features, recommended default |
| US West (Oregon) | us-west-2 | West Coast US, redundancy for us-east-1 |
| EU (Ireland) | eu-west-1 | EU audiences, GDPR data residency |
| EU (Frankfurt) | eu-central-1 | German/DACH audiences, strict data residency |
| Asia Pacific (Singapore) | ap-southeast-1 | SE Asia audiences only |
Step 3: Request production access
Account Dashboard → Request Production Access. Fill out the form carefully — vague answers cause delays. See our production access guide for the exact wording that gets approved in under 24 hours.
Step 4: Verify your sending domain
SES Console → Verified Identities → Create Identity → Domain. AWS gives you four DNS records to add:
- One TXT record for SPF
- Three CNAME records for Easy DKIM (2048-bit)
Propagation typically takes 15–30 minutes. The SES console shows a green "Verified" badge when done. While waiting, set up your DMARC record at _dmarc.yourdomain.com.
Step 5: Create a configuration set
SES Console → Configuration Sets → Create Configuration Set. Name it marketing. Add an SNS event destination and select Bounces and Complaints. This is how SES Mailbox — and your own code — receives real-time notifications when emails bounce or recipients report spam.
Step 6: Generate IAM credentials
IAM Console → Users → Create User → Attach policies directly. Create a custom inline policy:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ses:SendEmail",
"ses:SendRawEmail",
"ses:GetSendQuota",
"ses:GetSendStatistics",
"ses:ListIdentities",
"ses:DescribeConfigurationSet"
],
"Resource": "*"
}
]
}Pricing calculator
| Emails/month | AWS SES cost | SES Mailbox Pro | Total | vs Mailchimp Standard |
|---|---|---|---|---|
| 10,000 | $1.00 | $9.99 | $10.99 | $299/mo → save $288 |
| 50,000 | $5.00 | $9.99 | $14.99 | $750/mo → save $735 |
| 100,000 | $10.00 | $9.99 | $19.99 | $1,300/mo → save $1,280 |
| 280,000 | $28.00 | $9.99 | $37.99 | $1,200/mo → save $1,162 |
| 1,000,000 | $100.00 | $9.99 | $109.99 | ~$4,700/mo → save $4,590 |
Frequently asked questions
How long does it take to get out of AWS SES sandbox mode? +
AWS typically approves production access requests within 24 hours for well-documented requests. If you submit on a Friday, expect 1–2 extra days. Vague descriptions or new domains can push approval to 2–3 business days. See our dedicated guide on production access for word-for-word answers that work.
Which AWS region should I use for SES? +
Use us-east-1 (N. Virginia) unless you have a specific data residency requirement. It has the longest history and broadest feature availability. eu-west-1 (Ireland) is the best choice for EU-based businesses. Avoid ap-southeast-1 (Singapore) for US audiences as latency adds no benefit and the region has fewer dedicated IP options.
What IAM permissions does SES Mailbox need? +
At minimum: ses:SendEmail and ses:SendRawEmail. For full SES Mailbox functionality also add ses:GetSendQuota, ses:GetSendStatistics, ses:ListIdentities, and ses:DescribeConfigurationSet. Create a dedicated IAM user (not a role) with these permissions only — do not use root credentials or overly broad policies.
What is a configuration set and do I need one? +
A configuration set is a collection of rules applied to emails you send. It lets you route bounce and complaint notifications to SNS topics, publish send events to Kinesis Firehose for analytics, and override IP pools. You need at least one configuration set to receive bounce and complaint notifications, which are required to maintain healthy sending metrics.
What is the difference between a dedicated IP and a shared IP in SES? +
Shared IPs are used by many AWS customers simultaneously. Their reputation is pooled, which is fine for clean lists. Dedicated IPs are exclusively yours — your reputation is entirely your own. Dedicated IPs cost $24.95/month each in AWS SES and only make sense if you send over 50,000 emails per day and have excellent list hygiene.
Does AWS SES have a free tier? +
Yes. If you send from an application hosted on AWS (EC2, Lambda, etc.), the first 62,000 emails per month are free. From outside AWS infrastructure, the free tier is 200 emails per day in sandbox mode only. Production access costs $0.10 per 1,000 emails with no monthly minimum.
