Send WordPress email through Amazon Simple Email Service with an IAM access key, a verified domain and the right AWS region.

This guide shows you how to connect CRM-NG SMTP to Amazon Simple Email Service (SES). SES suits sites that already use Amazon Web Services, or that send a lot of mail and want a low cost per message. AWS offers a limited free allowance for new accounts; check the AWS site for the current terms.

The Amazon SES mailer uses the SES v2 API. Each request is signed with your access key using AWS Signature Version 4, so you need an access key, its secret, and the region where your sending identity lives.

Before you start

• An AWS account and permission to use the SES and IAM consoles.
• A domain you control, with access to its DNS records.
• Administrator access to your WordPress site.

Step 1: Pick a region and verify your domain

1. Choose a region

   Open the SES console at https://console.aws.amazon.com/ses/ and pick a region in the top-right menu, for example us-east-1 or eu-west-1. Identities, limits and sandbox status are separate in each region, so do all the SES steps in the same one.

2. Create an identity

   Open Configuration → Identities (older layouts say Verified identities) and choose Create identity. Pick Domain and enter your domain.

3. Turn on DKIM

   Keep Easy DKIM selected. SES shows three CNAME records.

4. Publish the records

   Add the three CNAME records at your DNS provider. If your DNS is in Route 53 in the same account, SES can add them for you.

5. Wait for verification

   The identity status changes to Verified once SES sees the records. This usually takes minutes but can take up to a few days.

You can verify a single email address instead of a domain, but a verified domain with DKIM gives much better delivery. See Adding DNS records.

Step 2: Leave the sandbox

New SES accounts start in the sandbox. While in the sandbox, you can only send to addresses you have verified, and daily sending is very low.

1. Open the account dashboard

   In the same region, open Account dashboard in the SES console.

2. Request production access

   Choose Request production access (the button name may vary slightly). Describe your website, the kind of mail it sends, and how you handle bounces and complaints.

3. Wait for AWS

   AWS usually replies within a day. Until then, test only with verified recipient addresses.

Step 3: Create an IAM user and access key

1. Open IAM

   Go to https://console.aws.amazon.com/iam/ and open Users → Create user. Give it a name such as website-mail. It does not need console access.

2. Grant only sending

   Choose to attach a policy. The simplest choice is an inline policy that allows the actions ses:SendRawEmail and ses:SendEmail. The managed policy AmazonSESFullAccess also works, but grants far more than the site needs.

3. Create the access key

   Open the new user, go to Security credentials → Access keys → Create access key, and choose the use case for an application running outside AWS.

4. Copy both values

   Copy the Access key ID (it starts with AKIA) and the Secret access key. AWS shows the secret only once.

A minimal inline policy looks like this:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["ses:SendRawEmail", "ses:SendEmail"],
      "Resource": "*"
    }
  ]
}

Step 4: Connect in CRM-NG SMTP

1. Choose the mailer

   In WordPress, open CRM-NG SMTP → Settings → General and set Mailer to Amazon SES.

2. Set the sender

   Set From Email to an address on your verified domain and set From Name. Tick Force From Email so other plugins cannot send from an unverified address.

3. Enter the key

   Paste the access key ID into Access Key ID and the secret into Secret Access Key.

4. Enter the region

   Type the region code into Region, exactly as AWS writes it, for example eu-west-1. It must be the region where your identity is verified.

5. Save

   Press Save Settings.

To keep the secret out of the database, you can set it in wp-config.php instead. See Securing settings with wp-config constants.

Send a test email

Open CRM-NG SMTP → Tools → Email Test, enter a recipient in Send To, and press Send Email. While still in the sandbox, the recipient must be a verified address too. See Sending a test email.

SES passes DMARC through DKIM. For SPF alignment as well, you can set up a custom MAIL FROM domain on the identity in the SES console.

Troubleshooting

• The From address or recipient is not verified in this region: Email address is not verified
• SES refuses the message: MessageRejected
• Wrong key, secret, or a server clock that is off: Invalid signature or credentials
• You have hit your daily quota or sending rate: Email sending limit reached
• The server cannot reach AWS: cURL error
• Mail arrives in spam: Emails landing in spam

Related

• Choosing a mail service
• Adding DNS records: SPF, DKIM and DMARC
• Verifying your DNS records
• Delivery and bounce webhooks
• Sharing credentials with support safely