A website sends more email than it seems: the notice from a contact form, an order confirmation, the link to reset a password. By default the server sends them itself, unaided, and the big email providers distrust any random server: many end up in spam or are rejected outright. The usual solution is for the website to hand its emails to a specialised service, and Amazon SES is one of the cheapest and most reliable.
Most applications, WordPress included, know how to send via SMTP, the classic email protocol. SES offers exactly that: an SMTP server with a username and a password. This guide creates them and puts them into the website.
Before you start: what each thing means
- SES
- Simple Email Service, Amazon's service for applications to send email.
- SMTP
- The protocol programs use to send email to a mail server. Almost any application supports it: it only needs the server address, the port, a username and a password.
- SMTP credentials
- The username and password SES gives you to send via SMTP. They are not your AWS user: SES creates specific ones.
- Verified identity
- A domain or email address you have proven to Amazon is yours. You can only send "from" a verified identity.
- Sandbox
- The test mode every SES account starts in: it only allows sending to verified addresses. For a real website you have to request to leave it (guide in this section).
- Port 587 and TLS
- The port is the "door" of the server through which email is sent; 587 is the standard one for authenticated sending. TLS (or STARTTLS) is the encryption of the connection.
- Region
- The place in the world where your SES is. The SMTP server address includes the region.
Step by step
Check that the sender is verified
In the SES console, choose the region you are going to use (for example Ireland,
eu-west-1) and go to Identities. The domain your website sends from (midominio.com) must appear as verified or, at the very least, the exact address (web@midominio.com). If there is nothing, verify the domain following the DKIM, SPF and DMARC guide in this section: without it, SES will not let you send and the emails would go to spam anyway.Create the SMTP credentials
In the SES menu, SMTP settings. Note down the server address, which has the form
email-smtp.eu-west-1.amazonaws.com, and port 587. Click Create SMTP credentials: it takes you to IAM with a suggested username (something likeses-smtp-user); you can change it tosmtp-web-empresaso you know what it is for. Create the user and, on the last screen, download or copy the SMTP username and password. The password is only shown this once. Keep it in a password manager.Configure WordPress
Install an SMTP sending plugin (there are several widely used ones; search for "SMTP" in the plugin installer). In its settings choose "Other SMTP" or "Amazon SES via SMTP" and fill in: server
email-smtp.eu-west-1.amazonaws.com, port587, encryption TLS, authentication on, SMTP username and password from step 2. Sender address and name: an address on your verified domain (web@midominio.com) and your company name. Save.Or configure any other application
The same five pieces of data work for any program that sends email: server, port 587, TLS, username and password. In an application of your own they usually go in a configuration file or in environment variables; do not write them into the code. If the application allows it, also add a header or tag that identifies which website the emails come from: it will help when you have several.
Send a test
SMTP plugins have a "send test email" button. Send it to an account of yours. If you are still in the SES sandbox, that account must be an address verified in SES; if not, SES will reject the send with a clear message. Open the received email and check that the sender is yours and that it has not landed in spam.
Request to leave the sandbox and keep an eye on sending
For the website to be able to write to any address, ask AWS to take you out of the sandbox (guide in this section). Afterwards, in SES, Account dashboard, you will see how many emails go out each day and what percentage bounces or is marked as spam. Look at that screen from time to time: it is the health of your website's email.
What can go wrong
The test email fails with "Email address is not verified"
Either the sender is not a verified identity in that region, or you are in the sandbox and the recipient is not verified either. Check the region of the SMTP server and that of the identity: they must match.
It fails with "authentication credentials invalid"
SMTP credentials are not the normal IAM access keys, although they look alike: you have to use exactly the SMTP password SES generated. If you lost it, create new ones and delete the old user.
It sends, but lands in spam
Domain authentication is missing (DKIM, SPF, DMARC) or the content looks like spam. Follow the domain verification guide; then check that the sender is on your domain and not a free one.
The server cannot connect on port 587
Some hosting providers block outbound email ports. Try 2587 (SES also accepts it with TLS) or ask your provider to open it. On new Lightsail and EC2 machines, AWS restricts port 25, but 587 works.
In Simplio
In Simplio the Email (SES) screen shows your identities by region and tells you whether the domain is verified and which DNS records are missing; with one button it generates SMTP credentials with send-only permissions and shows you the five pieces of data to paste into WordPress or your application. Afterwards you see sends, bounces and complaints for all your accounts in the same place, with a notice by email if the bounce rate climbs.
The same task, in AWS and in Simplio
| In the AWS console | In Simplio | |
|---|---|---|
| Create credentials and configure them | SES, IAM, the website plugin: 3 tools, 6 steps, about 20 minutes | "SMTP credentials" button on the Email screen: gives you the 5 pieces of data ready to paste, 1 minute |
| Know whether the website's email is going out properly | Open SES, region by region | Sent, bounces and complaints for all your accounts on one screen, with a notice if they spike |
| Several websites and several accounts | Repeat everything in each one | The same, in the same list |