AWS SES

Verified domains, sending limits, and bounce handling.

Amazon SES is the default production email provider — lowest cost and native AWS integration.

Domain verification

SES Console → Verified identities → Create identity → Domain
Add the DKIM CNAME records to Route 53 (or your DNS provider)
Add SPF record: v=spf1 include:amazonses.com ~all
Enable DKIM signing (3 CNAME records provided by SES)

Environment

dotenv

EMAIL_PROVIDER=ses
EMAIL_FROM=noreply@example.com
AWS_REGION=us-east-1

ECS tasks send via the task IAM role — no API key needed.

IAM policy (task role)

json

{
  "Effect": "Allow",
  "Action": ["ses:SendEmail", "ses:SendRawEmail"],
  "Resource": "*",
  "Condition": {
    "StringEquals": { "ses:FromAddress": "noreply@example.com" }
  }
}

Sandbox vs production

Mode	Limit	How to exit
Sandbox	Send only to verified addresses	Request production access in SES console
Production	50,000/day (default, increase via support)	Auto after approval

Alpha/Beta environments may stay in sandbox — verify test recipient addresses.

Bounce and complaint handling

Configure SNS topics for bounces and complaints:

SES → Configuration sets → create production
Add event destinations → SNS topics ses-bounces, ses-complaints
Lambda or worker processes SNS events to suppress bad addresses

When to use SES

Default for Production transactional email
Password resets, invoices, system alerts
When cost and AWS-native integration matter

Express implementation

See Email — Backend guide for the SesProvider adapter.