Amazon SES with WordPress: Setup, Sandbox and Real Costs

To send WordPress email through Amazon SES, you verify your domain in the SES console with Easy DKIM, add a custom MAIL FROM subdomain so SPF aligns, ask AWS to move your account out of the sandbox, then connect WordPress with an SMTP plugin using SES SMTP credentials or an API connection. At the time of writing (November 2026), sending costs $0.10 per 1,000 emails, which makes SES the cheapest mainstream option for busy sites. The trade-off is a more technical setup than most providers.

This guide walks through each step in order, with the settings to enter, the mistakes that stop SES working, and how to test before you rely on it. It suits WordPress and WooCommerce owners who are comfortable editing DNS records, and the developers who set up sites for them.

#Is Amazon SES right for your site?

Amazon SES suits sites that send a lot of email, or that will. A WooCommerce store, a membership site or a web app sending tens of thousands of messages a month pays very little with SES. A five-page brochure site with a contact form will barely notice the saving and may be happier with a simpler provider. My comparison of transactional email providers sets SES against Brevo, Postmark, Mailgun and others.

Be ready for three things SES does differently. Your account starts in a sandbox and AWS reviews your request to leave it. You create everything per region. And SES does not keep a message-by-message log for you; you must set up bounce and complaint notifications yourself.

#The setup at a glance

#Step 1: Choose your AWS Region

Pick one region and do every step in it, because identities, sandbox status and SMTP credentials are all separate per region. Choose a region that offers an SMTP endpoint if you plan to use SMTP: AWS lists SMTP endpoints for Mumbai (ap-south-1), Singapore, Frankfurt, Ireland, North Virginia and many others, but not for some newer regions such as Hyderabad (ap-south-2). For an Indian business, Mumbai is the natural choice; for a site whose customers are mostly in Europe or the US, pick a region there.

#Step 2: Verify your domain with Easy DKIM

Verifying the whole domain lets you send from any address on it, such as orders@ or noreply@.

1. Open the SES console and go to Configuration > Identities, then choose Create identity.
2. Select Domain and enter your domain without "www", for example example.com.
3. Leave DKIM on Easy DKIM with the default RSA_2048_BIT key length, and keep DKIM signatures enabled.
4. Choose Create identity. SES shows three CNAME records under Publish DNS records.
5. Add the three CNAME records at your DNS host exactly as shown. The underscore in ._domainkey is required; do not add an extra one at the start.
6. Wait for the status to show Verified. AWS says DNS changes can take up to 72 hours, though it is often much quicker.

A common mistake is the DNS host adding your domain to the end of the record name automatically, giving abc._domainkey.example.com.example.com. If verification stalls, check for that first.

#Step 3: Add a custom MAIL FROM domain

By default SES uses its own amazonses.com subdomain as the bounce address (the MAIL FROM or Return-Path). SPF passes, but for SES, not for your domain, so SPF does not count towards DMARC. A custom MAIL FROM subdomain fixes that.

1. Open your verified domain identity and find Custom MAIL FROM domain, then choose Edit.
2. Tick Use a custom MAIL FROM domain and enter a subdomain you use for nothing else, such as bounce.example.com. AWS says it must not be a subdomain you send from or receive mail on.
3. For Behavior on MX failure, choose Use default MAIL FROM domain so mail still goes out if the record breaks.
4. Add the two records SES shows:

Publish exactly one MX record on that subdomain; AWS says setup fails if there are more. Then add a DMARC record for your main domain if you do not have one. My guide to domain and business email setup explains what DMARC does and why Gmail and Outlook now expect it.

#Step 4: Request production access

Until AWS approves your account, SES only sends to addresses you have verified, up to 200 a day. To leave the sandbox:

1. In the SES console, open Account dashboard and choose View Get set up page, then Request production access.
2. Choose Transactional as the mail type if most of your mail is order, account and form email.
3. Enter your website URL and up to four contact addresses.
4. Tick the acknowledgement that you only email people who asked for it and that you handle bounces and complaints.
5. Submit. AWS says it gives an initial response within 96 hours, and may ask for more detail.

Verify your domain before you apply; AWS says this helps the request get approved faster. Explain briefly what emails the site sends and how people sign up. A vague request is the most common reason for a follow-up question.

#Step 5: SMTP credentials or API?

You can connect WordPress to SES in two ways, and both work well.

• SMTP credentials. In the SES console, open SMTP settings and choose Create SMTP credentials. This creates an IAM user and shows a username and password once; download them. Any SMTP plugin can use these.
• API keys. Some plugins connect to the SES API with an IAM access key that has permission to send. FluentSMTP includes an Amazon SES API connection in its free plugin, while WP Mail SMTP lists Amazon SES as a Pro feature.

The SMTP password is not your AWS secret access key, and it only works in the region you created it in. Never use your main AWS account keys in WordPress.

These are the SMTP settings to enter in the plugin:

My guide to the best WordPress SMTP plugins compares the plugins themselves, and SMTP settings explained covers ports and encryption if your host blocks one.

#Step 6: Set up bounce and complaint handling

AWS requires you to track bounces and complaints, through feedback notifications or event publishing. The simplest route is to send bounce and complaint notifications to an email address or an Amazon SNS topic. For a store or app, event publishing to SNS, CloudWatch or Firehose gives you a record of each delivery, bounce and complaint. AWS warns that high bounce and complaint rates can put your ability to send with SES at risk, so do not skip this.

#Step 7: Test before you rely on it

1. Send a test from the plugin's test screen to a Gmail and an Outlook address.
2. Open the message headers and check that SPF, DKIM and DMARC all show "pass", with your domain in the DKIM signature and the Return-Path.
3. Test the real flows: a contact form, a password reset and, on WooCommerce, a test order. If order emails still do not arrive, my guide to WooCommerce emails not sending covers the store-side causes.
4. Use the SES mailbox simulator to check that bounces and complaints reach your notification address.
5. Watch the SES account dashboard for the first week for bounce and complaint rates.

#What Amazon SES costs

SES charges per email with no monthly plan. At the time of writing (November 2026), the SES pricing page (opens in a new tab) lists:

per 1,000 outbound emails

$0.10

per GB of attachments sent

$0.12

per standard dedicated IP a month

$24.95

So a store sending 20,000 emails a month pays about $2 for sending, plus a little for attachments such as PDF invoices. New AWS accounts also receive Free Tier credits that can apply to SES. Optional extras such as Virtual Deliverability Manager ($0.07 per 1,000 emails) and dedicated IPs add to the bill, and most small senders do not need them. Check the pricing page before you start, because AWS updates it.

#When to get help

SES is cheap to run but easy to get wrong, and the cost of a mistake is lost order emails or a domain that lands in spam. Get help if:

• Your production access request was declined or AWS asked questions you are unsure how to answer.
• The domain already has email records for Google Workspace or Microsoft 365 and you are worried about breaking them.
• You run WooCommerce or a membership site where a missed email means a lost sale or a support ticket.
• You need bounce handling, event logs and alerts set up properly.

My SMTP and transactional email setup service covers SES from region choice to testing, and the email deliverability service fixes SPF, DKIM and DMARC problems on the wider domain.