Amazon SES

Connect Amazon SES for high-volume, cost-effective email sending at scale. SES offers some of the lowest per-email pricing in the industry.

Prerequisites

• An AWS account
• SES out of sandbox mode
• A verified identity (domain or email address)
• An IAM access key with SES permissions

Setup Steps

1. 1

   Create IAM credentials

   In the AWS IAM console, create a new user. Attach the AmazonSESFullAccess policy, then go to Security credentials > Create access key. Copy the Access Key ID and Secret Access Key immediately, they will not be shown again.
2. 2

   Note your SES region

   SES is region-specific. Note which AWS region your verified identities are configured in (e.g., us-east-1, eu-west-1).
3. 3

   Add the provider in GoodPostal

   Go to Configure > Email Providers, click "Add Provider", select Amazon SES, and enter your Access Key ID, Secret Access Key, and Region.
4. 4

   Choose automatic or manual setup

   Unlike the other sending services, SES setup is manual by default, because automatic setup creates resources inside your own AWS account. Tick Set up Amazon SES automatically and GoodPostal creates the SNS topic, the SES List Management contact list, and the configuration set for you. Leave it unticked and you do that work yourself, starting with the SNS topic.
5. 5

   Paste your SNS Topic ARN (manual setup only)

   If you left automatic setup unticked, an SNS Topic ARN field appears and it is required before you can save. Create your SNS topic in AWS first (see Manual Webhook Setup below), then paste its ARN, which looks like arn:aws:sns:us-east-1:123456789012:goodpostal-bounces.
6. 6

   Test the connection

   GoodPostal will automatically test the credentials by querying the SES API. If the test fails, verify the IAM user has SES permissions and the region is correct.

Credentials

Access Key ID: AKIAIOSFODNN7EXAMPLE
Secret Access Key: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
Region: us-east-1

Manual Webhook Setup

Skip this section if you ticked Set up Amazon SES automatically. GoodPostal already created and subscribed the topic for you.

SES uses Amazon SNS (Simple Notification Service) for delivery event notifications, so setting SES up by hand means creating an SNS topic and pointing your verified identity at it.

1. 1

   Create an SNS topic

   In the AWS SNS console, create a new Standard topic for SES delivery events. Create it in the same region as your SES verified identity. Copy its ARN into the SNS Topic ARN field in GoodPostal and save the connection.
2. 2

   Add an SNS subscription

   Once the connection is saved, the provider detail page shows an SNS Webhook Endpoint. Create an HTTPS subscription on your topic pointing at that URL. GoodPostal automatically confirms the SNS subscription request, as long as the ARN you saved matches the topic.
3. 3

   Point your identity at the topic

   In the SES console, open your verified identity, go to the Notifications tab, and set your new topic for Bounce and Complaint. Delivery is optional. Use this rather than a configuration set: GoodPostal does not stamp a configuration set on outbound mail when you set SES up manually, so a configuration set event destination receives nothing unless you also make it the default configuration set on the identity.

Recommended Events

• Bounce
• Complaint
• Delivery (optional)

Signature Verification

SES and SNS sign messages using X.509 certificates. GoodPostal automatically downloads and caches the signing certificate, then verifies each message's SHA1WithRSA signature. There is no webhook secret to set for SES.

What GoodPostal does need is the SNS Topic ARN saved on the provider. After the AWS signature passes, GoodPostal checks that the message came from the topic you bound to this connection, so a connection with no ARN saved rejects every event and cannot auto-confirm the subscription. Automatic setup creates the topic and stores its ARN for you.

Troubleshooting

• Sandbox mode - SES starts in sandbox mode, which only allows sending to verified email addresses. Request production access through the AWS console to send to any recipient.
• Access denied - Check that the IAM user has the AmazonSESFullAccess policy attached
• Wrong region - Ensure the region configured in GoodPostal matches the region where your SES identities are verified

See also: Webhook Configuration Guide