Set up Amazon SES from scratch

Amazon SES (Simple Email Service) is AWS’s email sending service, and a cheap way to send email: as little as $0.10 per 1,000. RadarSend can send through your own SES account, so you pay AWS directly for sending.

This guide is for you if you don’t have an AWS account yet, or have one but have never used SES. It takes you from a new account to one that’s ready to connect. Plan on about an hour of your time, plus a wait of up to a day or so while AWS verifies your domain and reviews your request to send.

You do all of this in your own AWS account, and RadarSend doesn’t do it for you. You own your sending setup, and knowing your way around the SES console helps when you want to raise your sending limits or try SES’s own deliverability tools later. Once you’ve connected, RadarSend shows what SES reports about your account and domains, so you can check each step from there. We’re always happy to walk you through it if you get stuck.

If you already send with SES, skip to Connect Amazon SES to RadarSend.

Before you begin#

• An email address for the account. For a business, use a shared address such as aws@yourcompany.com, not one person’s inbox. It becomes the account’s main sign-in and the address AWS contacts about billing and security.
• A payment card. AWS needs one even if you only use credits at first.
• A phone that can receive a text or call, for identity verification.
• Access to your domain’s DNS, so you can add the records SES gives you.
• A website at your sending domain. AWS checks it when you ask to leave the sandbox.

Step 1 — Create your AWS account#

1. Go to signin.aws.amazon.com/signup.
2. Enter the Root user email address and an AWS account name (your company name works well), then choose Verify email address.
3. Enter the code AWS emails you and choose Verify.
4. Create the root user password and choose Continue. It needs 8 to 128 characters, with at least three of uppercase, lowercase, numbers, and symbols.
5. Choose your account plan. Pick Paid plan, not Free plan.
   • A Free plan account closes itself after 6 months, or sooner if your credits run out. Your SES setup would go with it.
   • Both plans come with sign-up credits, and a Paid plan uses them up before charging you anything.
6. Enter your contact details and accept the AWS Customer Agreement. For a business, use a company phone number.
7. Enter your payment card. AWS places a temporary authorization of about $1 to check the card. It isn’t charged and usually disappears within a few business days.
8. Verify your identity: enter your phone number, choose Send SMS, and enter the code you receive.
9. Choose Basic support. It’s free, and it’s all you need for SES. Then choose Complete sign up.

Your account is usually ready within a few minutes, and AWS emails you when it’s active. It can occasionally take up to 24 hours.

Step 2 — Secure the account#

The root user you just created can do anything in the account, including closing it. Protect it before you go any further.

1. Turn on multi-factor authentication (MFA) for the root user. AWS requires this within 35 days of your first sign-in.
   1. Sign in, click your account name at the top right, and choose Security credentials.
   2. Under Multi-factor authentication (MFA), choose Assign MFA device.
   3. Name the device, choose a type, such as an authenticator app on your phone or a passkey, and follow the prompts.
   4. Adding a second device is a good idea, so losing a phone doesn’t lock you out.
2. Set a budget alert, so you hear about any unexpected charges.
   1. Open Billing and Cost Management and choose Budgets, then Create budget.
   2. Choose Use a template (simplified) and pick Monthly cost budget.
   3. Enter an amount you’d consider unusual, for example $20, and the email addresses to alert.
   4. Choose Create budget.
3. Don’t create access keys for the root user. RadarSend gets its own limited keys in Step 6.

Step 3 — Pick your SES region#

SES runs separately in each AWS Region. Your verified domain, sandbox status, and sending limits all belong to one region. Something set up in one region doesn’t carry over to another.

1. Sign in to the AWS console and search for Amazon Simple Email Service, or SES.
2. Use the region menu at the top right to choose where you’ll send from. Pick one near most of your recipients, for example US East (N. Virginia), which is us-east-1, or Europe (Ireland), which is eu-west-1.
3. Write the region code down. You’ll choose the same one in RadarSend, which lists regions by code.

Do every remaining step in this region.

Step 4 — Verify your sending domain#

Verifying your domain proves to SES, and to the mailbox providers that receive your email, that you’re allowed to send from it.

If this is your first time in SES, the console may open a Get started wizard that asks for an email address, your sending domain, and a pricing plan. You can use it, or skip it and follow these steps instead.

1. In the SES console, go to Configuration→Identities and choose Create identity.
2. Choose Domain and enter your domain, for example yourcompany.com, without www.
3. Use a custom MAIL FROM domain is optional, and recommended. Turn it on and enter a subdomain such as mail.yourcompany.com. This lets your SPF record line up with your domain, which helps DMARC (a policy that tells mailboxes what to do with email that fails these checks).
4. Leave Advanced DKIM settings on Easy DKIM with RSA_2048_BIT. DKIM is a signature that proves the email is yours.
5. Choose Create identity.

SES then shows the DNS records to add:

• 3 CNAME records for DKIM, on the identity’s Authentication tab. Download .csv record set saves them to a file.
• An MX record and a TXT (SPF) record for your MAIL FROM subdomain, if you set one up.

Add each one at your DNS host exactly as shown. Some DNS hosts add your domain to the end of the name automatically, so if the host shows yourcompany.com after the name field, leave it off the name you type.

SES checks for the records on its own. When it finds them, the identity shows Verified and DKIM shows Successful. This is often within an hour, but it can take up to 72 hours.

Step 5 — Choose your SES pricing plan#

In July 2026, AWS introduced SES pricing plans. New accounts start on Essentials, which bundles sending with SES’s deliverability tools. You can switch to paying for sending on its own.

To switch, open the Pricing plan page in the SES console and choose Cancel plan. Plans are set per region, so do it in the region you picked. For current prices, see AWS’s SES pricing page.

Step 6 — Request production access#

Every new SES account starts in the sandbox. There, SES only sends to addresses you’ve verified yourself, and at most 200 emails a day. To send to your contacts, ask AWS to move you to production.

Verify your domain first (Step 4). AWS reviews requests from verified domains faster.

1. In the SES console, open Account dashboard. A banner says your account is in the sandbox.
2. Choose View Get set up page, then Request production access.
3. Fill in the form:
   • Mail type — choose Marketing for newsletters and campaigns. If you’ll only send receipts and account email, choose Transactional.
   • Website URL — your company’s site at the domain you’re sending from.
   • Additional contacts — up to 4 more addresses to receive updates about the request.
   • Preferred contact language.
   • Tick the acknowledgement that you’ll only send to people who asked to hear from you, and that you have a process for bounces and complaints.
4. Choose Submit request.

AWS usually replies within 24 hours. It often opens a support case asking how you’ll use SES. Reply on that case, and be specific:

• Who you’ll email and how they signed up. For example, customers who opted in at checkout, or subscribers from a signup form on your site. Say you don’t buy or rent lists.
• What you’ll send and how often. For example, a weekly newsletter and occasional product announcements, and roughly how many emails a month.
• How you handle bounces and complaints. You send through RadarSend, which receives SES’s bounce and complaint notifications and stops sending to those addresses automatically.
• How people unsubscribe. Every email has an unsubscribe link, including one-click unsubscribe, handled by RadarSend.

If AWS declines, it’s usually because the answers were too vague. Reply on the same case with more detail rather than opening a new one.

Once approved, the Account dashboard shows your daily sending quota and maximum send rate. These vary by account; 50,000 emails a day is typical at the start. AWS raises them as you send well, and you can ask for more through the Service Quotas console.

Step 7 — Create access keys for RadarSend#

RadarSend connects to SES with an access key that belongs to an IAM user of its own. That user gets only the permissions RadarSend needs, and can’t sign in to the console. The policy lets RadarSend send, set up bounce and complaint tracking, and read your account and domain status. It can’t create, change, or delete your domains. See What the IAM policy allows.

First, get the permissions from RadarSend:

1. In RadarSend, go to Settings→Sending→Sending services and click + Connect a service.
2. Choose Amazon SES and click Continue.
3. Under IAM policy, click Copy policy JSON. Leave this window open; you’ll come back to it.

Then, in the AWS console:

1. Open IAM and choose Policies→Create policy.
2. Switch the editor to JSON, replace what’s there with the policy you copied, and choose Next.
3. Name the policy, for example radarsend-ses, and choose Create policy.
4. Choose Users→Create user. Name it, for example radarsend, and leave console access off. Choose Next.
5. Choose Attach policies directly, search for radarsend-ses, tick it, and choose Next, then Create user.
6. Open the new user, go to the Security credentials tab, and under Access keys choose Create access key.
7. For the use case, choose Third-party service (or Other, if that’s what you see). AWS shows some alternatives to long-term keys. Tick the confirmation and choose Next.
8. Optionally add a description, such as RadarSend, and choose Create access key.
9. Copy the Access key (it starts with AKIA) and the Secret access key, or choose Download .csv file. This is the only time AWS shows the secret.

Keep the keys somewhere safe, such as a password manager, and never email them or put them in a shared document.

Step 8 — Connect SES to RadarSend#

Back in RadarSend, on Enter your Amazon SES keys:

1. Choose your AWS Region, the code from Step 3.
2. Paste the Access Key ID and Secret Access Key.
3. Leave Configuration Set blank, and RadarSend creates one named radarsend.
4. Click Connect & verify.

RadarSend checks your keys and shows Connected · {region} · {rate}/sec. If AWS hasn’t approved production access yet, it adds · Sandbox and a note with a Request production access link for your region.

It then sets up bounce, complaint, and delivery tracking in your SES account. It creates a configuration set, an SNS topic, and an event destination, all with names starting with radarsend, so you’ll recognize them in the console. When it’s done, you’ll see Event webhooks configured. Click Save sending service.

Open the service from Settings→Sending→Sending services to check the rest of your setup:

• Amazon SES account shows Sandbox or Production, your 24-hour quota, and your maximum send rate.
• Verified sending domains lists your domains in that region, with their DKIM and custom MAIL FROM status. Your domain from Step 4 should show Verified.

Click Re-check to fetch the latest from SES. For more on the connection and what to do if it fails, see Connect Amazon SES to RadarSend.

Step 9 — Add your sender#

Finally, add the address you’ll send from. See Add and confirm a sender.

The address has to be on the domain you verified in Step 4. RadarSend sends a test through SES to confirm it. While you’re still in the sandbox, send that test to an address you’ve verified in SES. If SES rejects the test, RadarSend shows what SES says about the domain and links to it in the SES console.

Before your first broadcast, also set up your tracking domain, so RadarSend can measure opens and clicks.

Common issues#

• The domain stays “Pending”. SES can’t see the DNS records yet. Verified sending domains in RadarSend shows the same status SES does. Check that each CNAME matches exactly, and that your DNS host didn’t add your domain to the end of the name a second time. Then give it time; it can take up to 72 hours.
• Test sends fail with “Email address is not verified.” You’re still in the sandbox (the service’s page shows Sandbox), and the recipient isn’t a verified address. Verify the recipient in SES, or wait for production access.
• Your domain isn’t in Verified sending domains. It’s verified in a different region from the one RadarSend is connected to. That list only shows the connected region. Edit the sending service and choose the region where the domain shows Verified in SES.
• “Invalid AWS credentials.” The key was pasted with a missing character or an extra space, or it’s been deactivated. Check its status on the IAM user’s Security credentials tab, or create a new one.
• RadarSend says your IAM user isn’t allowed to call something. The policy on the user is missing a permission, often because it was attached before RadarSend’s policy changed. Copy the current policy from the connect wizard and replace the old one in IAM.
• Production access was declined. Reply on the same support case with specific answers: how contacts signed up, what you’ll send and how often, and how bounces, complaints, and unsubscribes are handled.
• I can’t find the Get set up page. Make sure you’re in the right region. Each region has its own SES account dashboard.

Good to know#

• Each region is separate. A second region means verifying the domain and requesting production access again there.
• Rotate your keys now and then, and whenever someone who had them leaves. Create a second key on the IAM user, update it in RadarSend, deactivate the old key, check that sending still works, then delete the old one. A user can have two keys at once.
• AWS changes its console often. If a button or menu here looks different, the step is usually still there under a similar name. AWS’s SES documentation has the current screens.
• Your SES limits grow with you. Sending steadily with low bounce and complaint rates is what gets AWS to raise them. See Deliverability and warmup.