AWS SES Setup Guide: Complete Email Delivery Configuration Tutorial

AWS SES Setup Guide: When "Simple" Turns Into Hours of DNS Hell

>

The Reality: Setting up AWS SES is not "click and ship." It's a multi-phase operation involving domain verification, DNS configuration, SMTP setup, and production access approval. But once it's done, it's bulletproof.

The Mission

• Full control over the email infrastructure
• Professional delivery from hi [at] bernhardrieder.com
• Scalable pricing ($0.10 per 1,000 emails)
• Industry-standard reliability

AWS SES Setup: The Five Phases

Phase 1: AWS SES Identity (The Verification)

1. Created Domain Identity in AWS SES Console
   • Navigated to SES → Verified identities
   • Clicked "Create identity"
   • Selected "Domain" and entered bernhardrieder.com
2. Generated DKIM Records (Easy DKIM)
   • AWS generated three CNAME records
   • These cryptographically sign my emails to prove they're legitimate
3. Added DNS Records to Cloudflare
   • Copied all three CNAME records
   • Pasted them into Cloudflare DNS settings
   • Critical: Set Proxy Status to "DNS Only" (Grey Cloud)
   • AWS cannot verify records if they're proxied through Cloudflare
4. Verified the "From" Email
   • Specifically verified hi [at] bernhardrieder.com
   • This ensures AWS knows this address is authorized to send

Phase 2: Deliverability (The Professional Polish)

>

Without Custom MAIL FROM, your emails show up as "via amazonses.com" in Gmail. That's amateur hour. Custom MAIL FROM makes your emails look professional and improves deliverability.

1. Set Up Custom MAIL FROM Domain
   • In the SES Identity settings, I configured mail.bernhardrieder.com
   • This subdomain becomes the technical sender
2. Added MX Record to Cloudflare
   • AWS provided an MX record
   • Priority: 10
   • Target: feedback-smtp.us-east-2.amazonses.com
   • Added to Cloudflare for mail.bernhardrieder.com
3. Added SPF Record (TXT)
   • AWS provided a TXT record for SPF
   • This tells email servers that AWS is authorized to send on my behalf
   • Added to Cloudflare for mail.bernhardrieder.com
4. Proxy Check
   • Ensured both records were set to "DNS Only"
   • AWS needs direct access to verify these

Phase 3: Sending Access (The Plumbing)

1. Created SMTP Credentials
   • Went to SES → SMTP Settings
   • Clicked "Create SMTP credentials"
   • AWS automatically created an IAM user
2. Named the IAM User
   • Used a clear name: bernhardrieder.com-smtp-user
   • This makes it easy to identify in the IAM console
3. Downloaded the Credentials
   • CRITICAL: The password is only shown once
   • Downloaded the .csv file immediately
   • Stored it securely in my project's .agent/ folder (gitignored)
4. Noted the SMTP Endpoint
   • My region: us-east-2 (Ohio)
   • Endpoint: email-smtp.us-east-2.amazonaws.com
   • Port: 587 (STARTTLS)

Phase 4: Production Access (The Final Boss)

1. Submitted Production Access Request
   • Navigated to SES → Account dashboard
   • Clicked "Request production access"
   • Filled out the form explaining my use case
2. Explained My Use Case
   • Newsletter for my personal website
   • Expected volume: ~1,000 emails/month initially
   • Opt-in subscribers only
   • Clear unsubscribe mechanism
3. Waited for Approval
   • AWS reviews these requests manually
   • Can take 24-48 hours
   • Current Status: Still waiting
4. Tested in Sandbox Mode
   • While waiting, I tested by sending to my own verified Gmail
   • Clicked "Send test email" in the SES console
   • Worked perfectly

Phase 5: Implementation (The Big Rig Integration)

1# AWS SES Configuration
2AWS_REGION="us-east-1"
3AWS_ACCESS_KEY_ID="[YOUR_ACCESS_KEY]"
4AWS_SECRET_ACCESS_KEY="[YOUR_SECRET_KEY]"
5
6# Newsletter Configuration
7NEWSLETTER_FROM_EMAIL="hi [at] bernhardrieder.com"
8
9# AWS SES SMTP Credentials
10SMTP_HOST="email-smtp.us-east-2.amazonaws.com"
11SMTP_PORT="587"
12SMTP_USERNAME="[YOUR_SMTP_USERNAME]"
13SMTP_PASSWORD="[YOUR_SMTP_PASSWORD]"

1. User enters email on newsletter page
2. API generates Firebase Email Link via generateSignInWithEmailLink()
3. API calls AWS SES to send verification email with that link
4. User clicks link in email → Firebase Auth completes sign-in
5. Subscription confirmed and subscriber record created

The Minimalist Cheat Sheet

Quick Setup Guide

• Create Domain Identity in AWS SES
• Generate DKIM records (3 CNAMEs)
• Add to Cloudflare DNS (Grey Cloud = DNS Only)
• Verify sender email address

• Set up Custom MAIL FROM (e.g., mail.yourdomain.com)
• Add MX record to DNS (Priority 10)
• Add SPF record (TXT) to DNS
• Ensure DNS Only (not proxied)

• Create SMTP credentials in SES
• Name IAM user clearly
• Download .csv file (password shown once!)
• Note SMTP endpoint for your region

• Request Production Access via SES dashboard
• Explain use case clearly
• Test with verified emails while waiting
• Wait 24-48 hours for approval

• Store credentials in .env.local
• Add to .gitignore
• Build API routes for sending
• Test thoroughly

Pro Tips for Future Setup

The Current Status

• ✅ Domain verified in AWS SES
• ✅ DKIM records configured
• ✅ Custom MAIL FROM set up
• ✅ SMTP credentials generated
• ✅ DNS records added to Cloudflare
• ✅ Handshake successful
• ✅ Test email sent and received
• ✅ API routes built and tested
• ✅ Environment variables configured

• ⏳ AWS Production Access approval (24-48 hours)

• Once approved, the newsletter goes live
• Subscribers can join via email or Google sign-in
• Verification emails will be sent automatically
• Archive of past issues will be public

The Aftermath

• Reading AWS documentation
• Configuring DNS records
• Waiting for verification
• Testing SMTP connections
• Debugging region mismatches
• Filling out production access forms

>

There is a specific satisfaction in building infrastructure that just works. No third-party service. No monthly fees per subscriber. Just clean, professional email delivery that I control completely.