Tutorial · 8 min read

Send your first email through AWS SES in 4 minutes

JR
Jules Rivera
April 28, 2026 · 8 min read
Cloud computing representing AWS infrastructure

Amazon Simple Email Service (SES) is the cheapest way to send bulk email at scale — $0.10 per 1,000 emails. Mailchimp charges $1,200/month for 280k subscribers. SES charges $28. This guide walks you through it end-to-end in four steps.

Sandbox vs. production — what actually changes

LimitSandboxProduction
Recipient restrictionVerified addresses onlyAnyone
Daily send quota200 emails/day50,000+ emails/day
Send rate1 email/second14 emails/second (default)
Bounce/complaint trackingLimitedFull SNS notifications
Configuration setsAvailableAvailable
Dedicated IPsNot availableAvailable ($24.95/mo each)

Step 1: Create an AWS account

Go to aws.amazon.com and click Create an AWS Account. You need a credit card on file. AWS will charge a $1 verification hold that is refunded immediately. Set up MFA on your root account before doing anything else — this is non-negotiable for a production sending environment.

Step 2: Choose your region

RegionCodeBest for
US East (N. Virginia)us-east-1US audiences, most features, recommended default
US West (Oregon)us-west-2West Coast US, redundancy for us-east-1
EU (Ireland)eu-west-1EU audiences, GDPR data residency
EU (Frankfurt)eu-central-1German/DACH audiences, strict data residency
Asia Pacific (Singapore)ap-southeast-1SE Asia audiences only

Step 3: Request production access

Account Dashboard → Request Production Access. Fill out the form carefully — vague answers cause delays. See our production access guide for the exact wording that gets approved in under 24 hours.

Step 4: Verify your sending domain

SES Console → Verified Identities → Create Identity → Domain. AWS gives you four DNS records to add:

  • One TXT record for SPF
  • Three CNAME records for Easy DKIM (2048-bit)

Propagation typically takes 15–30 minutes. The SES console shows a green "Verified" badge when done. While waiting, set up your DMARC record at _dmarc.yourdomain.com.

Step 5: Create a configuration set

SES Console → Configuration Sets → Create Configuration Set. Name it marketing. Add an SNS event destination and select Bounces and Complaints. This is how SES Mailbox — and your own code — receives real-time notifications when emails bounce or recipients report spam.

Step 6: Generate IAM credentials

IAM Console → Users → Create User → Attach policies directly. Create a custom inline policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ses:SendEmail",
        "ses:SendRawEmail",
        "ses:GetSendQuota",
        "ses:GetSendStatistics",
        "ses:ListIdentities",
        "ses:DescribeConfigurationSet"
      ],
      "Resource": "*"
    }
  ]
}
Warning: Never use your AWS root account credentials in SES Mailbox or any application. Create a dedicated IAM user with minimum required permissions only.

Pricing calculator

Emails/monthAWS SES costSES Mailbox ProTotalvs Mailchimp Standard
10,000$1.00$9.99$10.99$299/mo → save $288
50,000$5.00$9.99$14.99$750/mo → save $735
100,000$10.00$9.99$19.99$1,300/mo → save $1,280
280,000$28.00$9.99$37.99$1,200/mo → save $1,162
1,000,000$100.00$9.99$109.99~$4,700/mo → save $4,590

Frequently asked questions

How long does it take to get out of AWS SES sandbox mode? +

AWS typically approves production access requests within 24 hours for well-documented requests. If you submit on a Friday, expect 1–2 extra days. Vague descriptions or new domains can push approval to 2–3 business days. See our dedicated guide on production access for word-for-word answers that work.

Which AWS region should I use for SES? +

Use us-east-1 (N. Virginia) unless you have a specific data residency requirement. It has the longest history and broadest feature availability. eu-west-1 (Ireland) is the best choice for EU-based businesses. Avoid ap-southeast-1 (Singapore) for US audiences as latency adds no benefit and the region has fewer dedicated IP options.

What IAM permissions does SES Mailbox need? +

At minimum: ses:SendEmail and ses:SendRawEmail. For full SES Mailbox functionality also add ses:GetSendQuota, ses:GetSendStatistics, ses:ListIdentities, and ses:DescribeConfigurationSet. Create a dedicated IAM user (not a role) with these permissions only — do not use root credentials or overly broad policies.

What is a configuration set and do I need one? +

A configuration set is a collection of rules applied to emails you send. It lets you route bounce and complaint notifications to SNS topics, publish send events to Kinesis Firehose for analytics, and override IP pools. You need at least one configuration set to receive bounce and complaint notifications, which are required to maintain healthy sending metrics.

What is the difference between a dedicated IP and a shared IP in SES? +

Shared IPs are used by many AWS customers simultaneously. Their reputation is pooled, which is fine for clean lists. Dedicated IPs are exclusively yours — your reputation is entirely your own. Dedicated IPs cost $24.95/month each in AWS SES and only make sense if you send over 50,000 emails per day and have excellent list hygiene.

Does AWS SES have a free tier? +

Yes. If you send from an application hosted on AWS (EC2, Lambda, etc.), the first 62,000 emails per month are free. From outside AWS infrastructure, the free tier is 200 emails per day in sandbox mode only. Production access costs $0.10 per 1,000 emails with no monthly minimum.

Ready to start sending?

Free plan forever. No credit card required.

Start free →