Knowledge base
Send email through your own Amazon SES account
Connect your own Amazon SES account over SMTP: picking one region and staying in it, Easy DKIM, getting out of the sandbox BEFORE you connect, and why SMTP credentials are not your AWS access key.
You will need an AWS account and access to your domain's DNS. SES is the cheapest option on this list by a wide margin, and the one with the most steps.
Amazon's own documentation: Verifying a domain · Obtaining SMTP credentials · Moving out of the sandbox
⭐ We connect to SES over its SMTP interface, not its REST API. That is why you are asked for an SMTP username and password rather than an AWS access key. Both routes deliver exactly the same message; the SMTP one avoids an entire class of AWS request-signing problems that are miserable to diagnose from the outside, and it is the interface Amazon publishes credentials for precisely so tools like ours can use it.
1. Pick a region and stay in it
SES is regional. Everything below — your verified domain, your credentials, your sending quota — belongs to one AWS region and does not exist in any other.
Pick the one nearest your clients (eu-west-1 for Europe, us-east-1 for North America) and note it. Verifying your domain in Ireland and then creating credentials in Frankfurt is the commonest way to lose an afternoon here, and the error it produces says nothing about regions.
2. Verify your domain
Amazon SES console → Identities → Create identity → Domain. Enter a subdomain such as mail.yourdomain.com.
Turn on Easy DKIM and choose RSA_2048_BIT. SES gives you three CNAME records:
| Type | Host | | --- | --- | | CNAME | <token1>._domainkey.mail.yourdomain.com | | CNAME | <token2>._domainkey.mail.yourdomain.com | | CNAME | <token3>._domainkey.mail.yourdomain.com |
Add all three. Verification usually completes within the hour.
⭐ Also enable a custom MAIL FROM domain (bounce.mail.yourdomain.com) and add the MX and SPF TXT records it asks for. Without it your envelope sender is amazonses.com, so SPF aligns to Amazon rather than to you, and you are relying on DKIM alone.
3. Get out of the sandbox — this is the step people miss
⛔⛔ A new SES account is in a sandbox and can only send to addresses you have separately verified. It will accept everything else and deliver none of it.
This is exactly the failure our verification step exists to catch: in the sandbox, SES takes your message with a perfectly ordinary success response and then drops it. If you verify our setup by sending the test to an address you happen to have verified in AWS, it will work — and then every message to a real client will vanish.
Account dashboard → Request production access. Amazon asks what you send and how you handle bounces; a couple of honest sentences about transactional notifications to your own clients is normally approved within 24 hours.
⭐ Do this before you connect SES here. There is nothing to debug afterwards, because nothing fails.
4. Create SMTP credentials
SES console → SMTP settings → Create SMTP credentials.
This creates an IAM user with send-only permission and gives you an SMTP username and an SMTP password.
⛔ These are not your AWS access key and secret. They are derived from an IAM secret by a specific algorithm and they are not interchangeable. Pasting an AWS secret access key here will fail authentication every time, and the error will simply say the credentials were rejected.
⚠️ The password is shown once. Download the CSV before you leave the page.
5. Connect it in Zinn®
Open Email sending in your dashboard:
- Provider — Amazon SES
- Send from this domain —
mail.yourdomain.com - AWS region — the region from step 1, e.g.
eu-west-1 - SMTP username — from step 4
- Port — leave at 587
- SES SMTP password — from step 4
We build the host for you (email-smtp.<region>.amazonaws.com), so there is no hostname to mistype.
6. Send the test and enter the code
Press Send test message to an inbox on a different domain that you have not verified in AWS — a personal Gmail address is ideal, because it is the one that proves you are out of the sandbox. Read the code and enter it.
When it does not work
"Email address is not verified" while sending to a real client — you are still in the sandbox. Step 3.
535 Authentication Credentials Invalid — you used your AWS access key instead of SMTP credentials (step 4), or the credentials belong to a different region from the one you entered.
"Maximum sending rate exceeded" — a new production account starts at 14 messages per second and 50,000 per day. That is a great deal of notifications, but if you are migrating a large client base, request an increase first.
It worked in testing and stopped in production — check the SES Reputation dashboard. Amazon pauses sending automatically when a bounce or complaint rate crosses their threshold, and it is easy to cross with an old client list.
Still stuck?
Support is included on every plan and answers in your own language.
Contact support → All articles →