Amazon SES Deliverability: SPF, DKIM Setup and Bounce Handling Guide

Best Practices

Amazon Simple Email Service (SES) is AWS's email sending platform used primarily for transactional email — order confirmations, password resets, notifications, and application-generated messages. SES gives you more control (and more responsibility) than most ESPs. Deliverability is entirely in your hands.

Here's how to configure SES for reliable inbox placement.

What Makes SES Different

SES is not a marketing ESP. It's infrastructure. That means:

• No built-in templates or drag-and-drop editors — You build emails yourself (or use a service layer on top)
• You manage reputation directly — SES provides tools but doesn't handle deliverability for you
• Strict sending limits — SES starts new accounts in a sandbox with severe volume restrictions
• Pay-per-email pricing — Cost scales linearly with volume
• Full control over IP, authentication, and sending behavior — More power, more responsibility

Many applications use SES for transactional email while using a dedicated marketing ESP (Mailchimp, Klaviyo, etc.) for campaigns. This separation is a good practice for deliverability.

Authentication Setup

SPF Record

The SPF include for Amazon SES:

include:amazonses.com

Add it to your existing SPF record:

v=spf1 include:_spf.google.com include:amazonses.com ~all

If you send from a specific SES region, you can be more specific (e.g., include:us-east-1.amazonses.com), but amazonses.com covers all regions.

Check your SPF record to verify it's valid after making changes.

DKIM with Easy DKIM

SES provides "Easy DKIM" — an automated DKIM signing feature:

Once verified, SES automatically signs all outgoing email with DKIM. The signing domain aligns with your From domain, which satisfies DMARC alignment requirements.

DMARC Record

Add a DMARC record if you don't have one:

v=DMARC1; p=quarantine; rua=mailto:[email protected]

SES recommends progressing to p=reject once you've confirmed all legitimate email passes authentication.

Moving Out of the SES Sandbox

New SES accounts start in the sandbox. In sandbox mode:

• You can only send to verified email addresses
• Daily sending limit is 200 emails
• Sending rate is limited to 1 email per second

To move to production:

1. Request production access through the SES console
2. Provide details about your use case, expected volume, and how you handle bounces and complaints
3. AWS reviews your request (typically within 24 hours)
4. Once approved, you can send to any address, with limits that increase based on your sending behavior

Building Your Sending Quota

After leaving the sandbox, SES starts you with a modest daily quota (often 50,000) and increases it automatically as you demonstrate good sending behavior:

• Low bounce rates (below 5% — SES's hard limit is 10%)
• Low complaint rates (below 0.1% — SES's hard limit is 0.5%)
• Consistent sending volume

If you exceed bounce or complaint thresholds, SES can pause your sending ability entirely.

Bounce and Complaint Handling

This is where SES is most demanding. SES requires you to handle bounces and complaints programmatically. Ignoring them risks account suspension.

Setting Up Notifications

SES sends bounce and complaint notifications through Amazon SNS (Simple Notification Service):

1. Create an SNS topic for bounces and another for complaints
2. Subscribe your application endpoint to these topics
3. In SES, configure your domain identity to send notifications to the SNS topics
4. Process notifications in your application

Bounce Types

Complaint Processing

When a recipient marks your email as spam, SES receives the complaint through feedback loops and forwards it to your SNS topic. You must:

1. Immediately suppress the address from future sends
2. Never re-add the address without explicit re-consent
3. Log the complaint for analysis

SES monitors your complaint rate. If it exceeds 0.5%, SES places your account under review. If it reaches 1%, SES may suspend your sending.

The SES Account Dashboard

The SES console provides a reputation dashboard showing:

Monitor this dashboard daily. SES is less forgiving than consumer-focused ESPs — they will suspend accounts that exceed thresholds.

Dedicated IPs in SES

SES offers dedicated IPs for senders who want full control over their reputation:

• Standard dedicated IPs — Fixed IP addresses assigned to your account
• Managed dedicated IPs — SES manages warmup and reputation on your behalf

If you send fewer than 100,000 emails per day, shared IPs are usually fine. For higher volumes or sensitive transactional email, dedicated IPs provide isolation.

Warming Up Dedicated IPs

SES provides automatic warmup for dedicated IPs. During warmup, SES gradually shifts traffic from shared to dedicated IPs over a period of weeks. Monitor bounce rates and complaint rates during this transition.

SES Configuration Sets

Configuration sets let you apply specific rules to different types of email:

• Tracking — Enable open and click tracking for specific email types
• Reputation monitoring — Track per-configuration-set reputation metrics
• IP assignment — Route different email types through different dedicated IPs
• Event publishing — Send delivery events to Kinesis, CloudWatch, or SNS for monitoring

Use configuration sets to separate transactional email from marketing email, each with its own tracking and IP assignment.

Common SES Issues

Account Placed Under Review

SES can place your account under review if bounce or complaint rates spike. While under review:

• You can still send, but SES monitors closely
• If metrics don't improve, sending is paused

Fix: Immediately reduce volume. Send only to your most recent, verified addresses. Fix the root cause (list quality, authentication, content).

Emails Going to Spam

SES delivers your email to the receiving server, but inbox vs spam placement depends on your authentication, reputation, and content:

• Verify authentication is passing (SPF, DKIM, DMARC)
• Check domain reputation in Google Postmaster Tools
• Review email content for spam triggers
• Check blacklists for your domain and sending IPs

Throttling Errors

If you send faster than your per-second rate limit, SES returns throttling errors. Implement exponential backoff in your sending code, or request a rate increase through the SES console.