Amazon SES SMTP Settings and Configuration (2026)
Native SMTP relay on every SES region
Amazon SES exposes a first-party SMTP interface on every commercial and GovCloud region. Endpoint is email-smtp.{region}.amazonaws.com on port 587 (STARTTLS) or 465 (TLS wrapper), authenticated with region-specific IAM SMTP credentials.
Amazon SES is the reference “pay-per-email” relay: $0.10 per 1,000 outbound messages on the a-la-carte plan, no monthly minimum, and native pipes into every neighbouring AWS service. The SMTP interface is a straight wrapper around the SES v2 API, so anything you send through email-smtp.{region}.amazonaws.com shows up in the same CloudWatch metrics, event destinations and suppression list as API sends. If you want a managed dashboard and templates without touching IAM, compare with SendGrid or Postmark; for a lower-friction pay-as-you-go alternative outside AWS look at Mailgun or SparkPost.
Quick reference
| SMTP server | email-smtp.{region}.amazonaws.com e.g. email-smtp.us-east-1.amazonaws.com |
|---|---|
| Port (STARTTLS) | 587 RECOMMENDED |
| Port (TLS wrapper) | 465 |
| Alternative port | 2587 (STARTTLS) or 2465 (TLS wrapper) — use if 587/465 are blocked upstream |
| Username | IAM SMTP username (20-char alphanumeric string, generated in the SES console) |
| Password | IAM SMTP password (44-char base64 string, HMAC-SHA256 derived, region-specific) |
SMTP configuration
Regional SMTP relay over TLS
Route transactional and bulk email from any SMTP-capable stack (WordPress, PostgreSQL triggers, Rails, PHP mailers, appliances) through Amazon SES using IAM SMTP credentials scoped to the region where your identity is verified.
Setup steps
- In the SES console, open Verified identities and add either a domain (recommended) or a single email address. For a domain, publish the three DKIM CNAME records SES generates. Verification typically completes in under 72 hours.
- Open SMTP settings in the SES console, click Create SMTP credentials, and let SES create the backing IAM user. Copy the 20-char username and 44-char password immediately — the password is shown only once.
- Configure your application with hostname email-smtp.{region}.amazonaws.com, port 587, STARTTLS required, and the SMTP username/password. Set the From address to a verified identity.
- Send a first test to a verified recipient (mandatory while your account is in the sandbox). Confirm the message appears in CloudWatch metrics for the same region.
- Request production access via Account dashboard › Request production access. Provide use case, expected volume, and how you handle bounces, complaints and unsubscribes. Approvals typically land within 24 hours.
Authentication
SPF and DKIM setup
SES signs every outbound message with Easy DKIM once you publish three CNAME records. SPF is optional but recommended if you want SPF-based DMARC alignment; SES’s own Return-Path domain (amazonses.com) already passes SPF, so aligning SPF with your organisational domain requires configuring a custom MAIL FROM subdomain.
; SPF (organisational domain) — optional, needed for SPF alignment
yourdomain.com. IN TXT "v=spf1 include:amazonses.com ~all"
; DKIM (Easy DKIM, published in the SES console)
{token1}._domainkey.yourdomain.com. IN CNAME {token1}.dkim.amazonses.com.
{token2}._domainkey.yourdomain.com. IN CNAME {token2}.dkim.amazonses.com.
{token3}._domainkey.yourdomain.com. IN CNAME {token3}.dkim.amazonses.com.
; Custom MAIL FROM (optional, unlocks SPF alignment)
bounce.yourdomain.com. IN MX 10 feedback-smtp.{region}.amazonses.com.
bounce.yourdomain.com. IN TXT "v=spf1 include:amazonses.com ~all"If your domain is on Route 53, SES can publish the DKIM CNAMEs and MAIL FROM records for you in one click. On any other DNS provider you copy them manually. SES will not send from an identity whose DKIM status is Failed or Pending.
DMARC alignment
SES does not create a DMARC record for you. Publish a single _dmarc TXT record on your organisational domain, for example v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com, then tighten to p=quarantine or p=reject once your reports are clean. DKIM alignment works out-of-the-box because SES signs with d=yourdomain.com when Easy DKIM is on your identity. SPF alignment requires the custom MAIL FROM subdomain above — without it, the Return-Path stays on amazonses.com, SPF passes but does not align, and only DKIM alignment carries DMARC.
Rate limits & sending caps
| Limit | Value | Notes |
|---|---|---|
| Messages per second (sandbox) | 1 msg/sec, 200 messages per 24 h | Hard cap. Verified recipients only. |
| Messages per second (production, initial) | 14 msg/sec | Scales automatically with healthy sending. Base allocation set on production access grant. |
| Recipients per message | 50 (To + Cc + Bcc combined) | Same cap on SendBulkEmail Destinations per call. |
| Message size | 40 MB after base64 encoding | SES v1 legacy SendEmail: 10 MB. Messages over 10 MB are bandwidth-throttled to ~40 MB/s. |
| Concurrent SMTP connections | Not published as a hard number | Throughput governed by per-second send rate, not connection count. |
Bounce and complaint rates are enforced separately. SES puts an account under review at a 5% bounce rate or 0.1% complaint rate, and can pause sending at 10% bounces or 0.5% complaints. Wire bounce and complaint SNS notifications into your app on day one.
Common setup gotchas
SMTP credentials are not your AWS access keys
SES SMTP requires a distinct IAM SMTP username/password pair, generated in the SES console or derived from an IAM user’s secret via HMAC-SHA256. Using the raw AWS access key ID and secret against email-smtp.{region}.amazonaws.com will always return 535 Authentication Credentials Invalid. Generate credentials via SMTP settings › Create SMTP credentials, not via IAM directly.
SMTP credentials are region-specific
The SMTP password bakes the region into its signing string. Credentials generated for us-east-1 will fail against email-smtp.eu-west-1.amazonaws.com. Regenerate a separate SMTP credential set for every region you send from, and store them per-region in your secrets manager.
The sandbox is aggressive and easy to forget
New accounts — and every new region on an existing account — start in the SES sandbox: 200 messages per 24 h, 1 msg/sec, verified recipients only. Production access requires a support case describing use case, expected volume and bounce/complaint handling. Approvals typically land within 24 hours but can be denied or granted only partially.
EC2 blocks port 25 by default
Amazon throttles outbound TCP 25 on EC2 instances by default. Use port 587 or 2587 for STARTTLS, or 465/2465 for TLS wrapper. Applications hard-coded to port 25 will silently time out on EC2 until you file a Request to Remove Email Sending Limitations.
Migrating SMTP setups
Moving TO Amazon SES
Coming from SendGrid, Mailgun or Postmark? The playbook is: (1) verify your sending domain in one SES region and publish the three DKIM CNAMEs plus your existing SPF (add include:amazonses.com alongside the current provider); (2) create SMTP credentials in that region; (3) start dual-sending — keep your current provider live while a small percentage flips to email-smtp.{region}.amazonaws.com; (4) monitor CloudWatch and the SES reputation dashboard for a full week before requesting production access at your projected steady-state volume; (5) subscribe SNS topics to Bounce and Complaint feedback and wire them into your suppression logic before you ramp. Do not drop your legacy provider’s SPF include until reputation on SES is stable.
Moving FROM Amazon SES
The reverse migration is usually driven by wanting deliverability tooling and a dashboard without building it. Options: SendGrid and SparkPost both offer $0.10/1K-ish tiers with UI dashboards; Postmark is stricter on abuse and faster on support; Mailgun matches SES on pay-as-you-go pricing with more analytics baked in. Before you switch, export your SES suppression list (ListSuppressedDestinations) and import it into the destination provider’s suppression list so hard bounces stay suppressed. Rotate SPF to include the new provider first, wait for DNS propagation, cut over, then remove include:amazonses.com. Keep your SES identity verified for at least 30 days after cut-over in case you need to roll back.
Frequently asked questions
What is the Amazon SES SMTP server address for my region?
SES exposes a regional SMTP endpoint per region in the form email-smtp.{region}.amazonaws.com. Examples: email-smtp.us-east-1.amazonaws.com for N. Virginia, email-smtp.eu-west-1.amazonaws.com for Ireland, email-smtp.ap-southeast-2.amazonaws.com for Sydney. Always match the region where your identity is verified and your SMTP credentials were generated.
Which ports does Amazon SES SMTP accept for TLS and STARTTLS?
STARTTLS is available on ports 25, 587 and 2587. TLS wrapper (SMTPS) is available on ports 465 and 2465. Port 587 is the standard recommendation; use 2587 or 2465 if 587/465 are blocked upstream. SES refuses any unencrypted SMTP connection.
How do I generate Amazon SES SMTP credentials from an IAM user?
Open the SES console, go to SMTP settings, click Create SMTP credentials. SES will create a backing IAM user with the ses:SendRawEmail permission and give you a 20-character SMTP username plus a 44-character SMTP password. Copy the password immediately — it is shown once. You can also derive an SMTP password from an existing IAM user’s secret access key using the smtp_credentials_generate.py script AWS publishes.
Why do my SES SMTP credentials from us-east-1 fail in eu-west-1?
The SMTP password is HMAC-SHA256 derived using the region as part of the signing string. Credentials are therefore region-specific: a password minted for us-east-1 will always fail against email-smtp.eu-west-1.amazonaws.com with a 535 authentication error. Generate one credential set per region and store them separately.
How do I move my Amazon SES account out of the sandbox?
Open the SES console, go to Account dashboard, click Request production access. You will fill in your website URL, use case description, expected sending volume, how you handle bounces and complaints, and your unsubscribe process. AWS support typically responds within 24 hours. Sandbox limits are 200 messages per 24-hour period, 1 message per second, and verified recipients only, and they apply per region.
Why is my EC2 instance timing out on port 25 when sending through SES?
Amazon throttles outbound TCP 25 on EC2 instances by default to prevent abuse, so SMTP connections to email-smtp.{region}.amazonaws.com on port 25 will silently time out. Switch your client to port 587 or 2587 for STARTTLS, or 465 or 2465 for TLS wrapper — those ports are not throttled. If you must use port 25, file the Request to Remove Email Sending Limitations form on the EC2 instance.
This review follows our email infrastructure testing methodology. We disclose affiliate relationships in our editorial independence policy.
