# Amazon SES

Source: https://catalystgroup.gg/docs/email-delivery/mailer-amazon-ses/
Updated: 2026-10-19 · By Duane Garner

Send WordPress email through Amazon Simple Email Service with an IAM access key, a verified domain and the right AWS region.

This guide shows you how to connect CRM-NG SMTP to Amazon Simple Email Service (SES). SES suits sites that already use Amazon Web Services, or that send a lot of mail and want a low cost per message. AWS offers a limited free allowance for new accounts; check the AWS site for the current terms.

 

The **Amazon SES** mailer uses the SES v2 API. Each request is signed with your access key using AWS Signature Version 4, so you need an access key, its secret, and the region where your sending identity lives.

 

## Before you start

 
- An AWS account and permission to use the SES and IAM consoles.
- A domain you control, with access to its DNS records.
- Administrator access to your WordPress site.

 

> **Keys, not SMTP credentials:** SES can also create "SMTP credentials". Those are for SMTP connections and will not work here. This mailer needs an IAM **access key ID** and **secret access key**.

 

## Step 1: Pick a region and verify your domain

 
1. Choose a region
  Open the SES console at `https://console.aws.amazon.com/ses/` and pick a region in the top-right menu, for example `us-east-1` or `eu-west-1`. Identities, limits and sandbox status are separate in each region, so do all the SES steps in the same one.
2. Create an identity
  Open **Configuration → Identities** (older layouts say **Verified identities**) and choose **Create identity**. Pick **Domain** and enter your domain.
3. Turn on DKIM
  Keep Easy DKIM selected. SES shows three CNAME records.
4. Publish the records
  Add the three CNAME records at your DNS provider. If your DNS is in Route 53 in the same account, SES can add them for you.
5. Wait for verification
  The identity status changes to **Verified** once SES sees the records. This usually takes minutes but can take up to a few days.

 

You can verify a single email address instead of a domain, but a verified domain with DKIM gives much better delivery. See [Adding DNS records](https://catalystgroup.gg/docs/email-delivery/dns-records/).

 

## Step 2: Leave the sandbox

 

New SES accounts start in the sandbox. While in the sandbox, you can only send to addresses you have verified, and daily sending is very low.

 
1. Open the account dashboard
  In the same region, open **Account dashboard** in the SES console.
2. Request production access
  Choose **Request production access** (the button name may vary slightly). Describe your website, the kind of mail it sends, and how you handle bounces and complaints.
3. Wait for AWS
  AWS usually replies within a day. Until then, test only with verified recipient addresses.

 

## Step 3: Create an IAM user and access key

 
1. Open IAM
  Go to `https://console.aws.amazon.com/iam/` and open **Users → Create user**. Give it a name such as `website-mail`. It does not need console access.
2. Grant only sending
  Choose to attach a policy. The simplest choice is an inline policy that allows the actions `ses:SendRawEmail` and `ses:SendEmail`. The managed policy `AmazonSESFullAccess` also works, but grants far more than the site needs.
3. Create the access key
  Open the new user, go to **Security credentials → Access keys → Create access key**, and choose the use case for an application running outside AWS.
4. Copy both values
  Copy the **Access key ID** (it starts with `AKIA`) and the **Secret access key**. AWS shows the secret only once.

 

A minimal inline policy looks like this:

 

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["ses:SendRawEmail", "ses:SendEmail"],
      "Resource": "*"
    }
  ]
}
```

 

## Step 4: Connect in CRM-NG SMTP

 
1. Choose the mailer
  In WordPress, open **CRM-NG SMTP → Settings → General** and set **Mailer** to **Amazon SES**.
2. Set the sender
  Set **From Email** to an address on your verified domain and set **From Name**. Tick **Force From Email** so other plugins cannot send from an unverified address.
3. Enter the key
  Paste the access key ID into **Access Key ID** and the secret into **Secret Access Key**.
4. Enter the region
  Type the region code into **Region**, exactly as AWS writes it, for example `eu-west-1`. It must be the region where your identity is verified.
5. Save
  Press **Save Settings**.

 

> **Note:** If the **Region** field is empty or not a valid region code, CRM-NG SMTP uses `us-east-1`. A test that fails with "not verified" often means the identity lives in a different region.

 

To keep the secret out of the database, you can set it in `wp-config.php` instead. See [Securing settings with wp-config constants](https://catalystgroup.gg/docs/email-delivery/secure-settings-constants/).

 

## Send a test email

 

Open **CRM-NG SMTP → Tools → Email Test**, enter a recipient in **Send To**, and press **Send Email**. While still in the sandbox, the recipient must be a verified address too. See [Sending a test email](https://catalystgroup.gg/docs/email-delivery/send-a-test-email/).

 

SES passes DMARC through DKIM. For SPF alignment as well, you can set up a custom MAIL FROM domain on the identity in the SES console.

 

## Troubleshooting

 
- The From address or recipient is not verified in this region: [Email address is not verified](https://catalystgroup.gg/docs/email-delivery/error-ses-email-address-not-verified/)
- SES refuses the message: [MessageRejected](https://catalystgroup.gg/docs/email-delivery/error-ses-message-rejected/)
- Wrong key, secret, or a server clock that is off: [Invalid signature or credentials](https://catalystgroup.gg/docs/email-delivery/error-ses-invalid-signature-or-credentials/)
- You have hit your daily quota or sending rate: [Email sending limit reached](https://catalystgroup.gg/docs/email-delivery/error-email-sending-limit/)
- The server cannot reach AWS: [cURL error](https://catalystgroup.gg/docs/email-delivery/error-curl-error/)
- Mail arrives in spam: [Emails landing in spam](https://catalystgroup.gg/docs/email-delivery/emails-landing-in-spam/)

 

## Related

 
- [Choosing a mail service](https://catalystgroup.gg/docs/email-delivery/choose-a-mailer/)
- [Adding DNS records: SPF, DKIM and DMARC](https://catalystgroup.gg/docs/email-delivery/dns-records/)
- [Verifying your DNS records](https://catalystgroup.gg/docs/email-delivery/verify-dns-records/)
- [Delivery and bounce webhooks](https://catalystgroup.gg/docs/email-delivery/delivery-webhooks/)
- [Sharing credentials with support safely](https://catalystgroup.gg/docs/email-delivery/sharing-credentials-safely/)