Connect Amazon SES

Before you start

• An AWS account where you can create IAM users, SES resources and an SNS topic.
• A domain whose DNS you control. Use the exact domain you will send from: if you send from [email protected], the sending domain is mail.example.com.
• One AWS region for everything — the SES domain, the configuration set and the SNS topic, for example eu-central-1.
• Owner or admin access to the Sendalto workspace with two-factor sign-in turned on.
• Your workspace ID. Open Settings → Integrations, choose Configure on Amazon SES: the ID is part of the tenant name sendalto-WORKSPACE_ID and of the feedback address shown there.

Below, replace REGION, ACCOUNT_ID (your 12-digit AWS account ID), example.com (your sending domain) and WORKSPACE_ID with your values.

1. Create an IAM user with this policy

Create a dedicated IAM user for Sendalto without console access, attach the policy below as an inline policy, and create an access key for it. Sendalto stores the key encrypted for this workspace only.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AccountStatus",
      "Effect": "Allow",
      "Action": "ses:GetAccount",
      "Resource": "*"
    },
    {
      "Sid": "SendingDomain",
      "Effect": "Allow",
      "Action": [
        "ses:CreateEmailIdentity",
        "ses:GetEmailIdentity",
        "ses:PutEmailIdentityMailFromAttributes"
      ],
      "Resource": "arn:aws:ses:REGION:ACCOUNT_ID:identity/example.com"
    },
    {
      "Sid": "ConfigurationSet",
      "Effect": "Allow",
      "Action": [
        "ses:CreateConfigurationSet",
        "ses:GetConfigurationSet",
        "ses:GetConfigurationSetEventDestinations",
        "ses:PutConfigurationSetSuppressionOptions"
      ],
      "Resource": "arn:aws:ses:REGION:ACCOUNT_ID:configuration-set/sendalto-WORKSPACE_ID"
    },
    {
      "Sid": "Tenant",
      "Effect": "Allow",
      "Action": [
        "ses:CreateTenant",
        "ses:TagResource",
        "ses:GetTenant",
        "ses:ListTenantResources",
        "ses:PutTenantSuppressionAttributes"
      ],
      "Resource": "arn:aws:ses:REGION:ACCOUNT_ID:tenant/sendalto-WORKSPACE_ID/*"
    },
    {
      "Sid": "TenantResources",
      "Effect": "Allow",
      "Action": "ses:CreateTenantResourceAssociation",
      "Resource": [
        "arn:aws:ses:REGION:ACCOUNT_ID:tenant/sendalto-WORKSPACE_ID/*",
        "arn:aws:ses:REGION:ACCOUNT_ID:identity/example.com",
        "arn:aws:ses:REGION:ACCOUNT_ID:configuration-set/sendalto-WORKSPACE_ID"
      ]
    },
    {
      "Sid": "Send",
      "Effect": "Allow",
      "Action": "ses:SendEmail",
      "Resource": [
        "arn:aws:ses:REGION:ACCOUNT_ID:identity/example.com",
        "arn:aws:ses:REGION:ACCOUNT_ID:configuration-set/sendalto-WORKSPACE_ID"
      ]
    }
  ]
}

The policy lists exactly the SES API calls Sendalto makes with your key, and nothing else. Each one is limited to your domain, your configuration set and your tenant, except ses:GetAccount, which AWS does not allow to scope.

2. Create an SNS topic for feedback

In the Amazon SNS console, in the same region, create a topic of type Standard (SES does not publish to FIFO topics), for example sendalto-feedback. Copy its ARN, such as arn:aws:sns:REGION:ACCOUNT_ID:sendalto-feedback. Do not add a subscription yet — Sendalto confirms it only once the topic ARN is saved in the workspace.

3. Enter the details in Sendalto

1. Open Settings → Integrations and choose Configure on Amazon SES.
2. Enter the AWS region, the access key ID and the secret access key of the IAM user. Leave the session token empty: temporary credentials expire, and checks and sending stop when they do.
3. Enter the sending domain (a domain such as example.com, not an email address), keep the configuration set sendalto-WORKSPACE_ID, and paste the SNS topic ARN.
4. Choose Save encrypted credentials, then Create SES resources. Sendalto creates the tenant sendalto-WORKSPACE_ID, adds the domain and the configuration set, attaches both to the tenant and turns on suppression of bounced and complained addresses for that tenant. Resources that already exist are kept.

Saving new credentials resets the connection status and cancels sends queued through the old ones, so plan key rotation for a quiet moment.

4. Add the DNS records

Settings → Delivery shows the exact records for your domain and marks each one as found or missing. Your technical teammate can work there without access to contacts or credentials.

• DKIM. SES uses Easy DKIM: three CNAME records TOKEN._domainkey.example.com → TOKEN.dkim.amazonses.com. The tokens appear after Create SES resources.
• Custom MAIL FROM. Pick a subdomain such as bounce.example.com in Settings → Delivery (Sendalto sets it in SES with Reject message on MX failure, which the check requires), then add its MX and SPF records. If you set it in the SES console instead, choose Reject message as the behaviour on MX failure.
• DMARC. A TXT record exactly at _dmarc.<your sending domain> with p=none, p=quarantine or p=reject. Sendalto looks only at that name: if you send from mail.example.com, publish _dmarc.mail.example.com even if example.com has its own record. Start with p=none and a rua address for reports.

; DKIM (Easy DKIM): three records, tokens come from SES
TOKEN1._domainkey.example.com  CNAME  TOKEN1.dkim.amazonses.com
TOKEN2._domainkey.example.com  CNAME  TOKEN2.dkim.amazonses.com
TOKEN3._domainkey.example.com  CNAME  TOKEN3.dkim.amazonses.com

; Custom MAIL FROM, for example bounce.example.com
bounce.example.com  MX   10 feedback-smtp.REGION.amazonses.com
bounce.example.com  TXT  "v=spf1 include:amazonses.com ~all"

; DMARC, exactly at _dmarc.<sending domain>
_dmarc.example.com  TXT  "v=DMARC1; p=none; rua=mailto:[email protected]"

DNS changes can take from minutes to several hours to appear. SES verifies the domain once the DKIM records are visible.

5. Send bounces and complaints to Sendalto

1. In the SES console open Configuration sets → sendalto-WORKSPACE_ID → Event destinations → Add destination.
2. Select at least Hard bounces, Complaints, Deliveries and Rejects (Sendalto requires these four; others are optional), keep event publishing enabled, choose Amazon SNS and the topic from step 2.
3. Give SES permission to publish to the topic: in the SNS console edit the topic’s Access policy and add the statement below.
4. In the SNS console create a subscription on the topic: protocol HTTPS, endpoint https://sendalto.com/api/webhooks/email?workspace=WORKSPACE_ID with your workspace ID. Leave Enable raw message delivery off.
5. Sendalto verifies the signed confirmation from SNS and confirms the subscription by itself; the subscription turns Confirmed within a minute. If it stays Pending confirmation, check that the topic ARN saved in Sendalto is the same, then choose Request confirmation.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowSesEventPublishing",
      "Effect": "Allow",
      "Principal": { "Service": "ses.amazonaws.com" },
      "Action": "sns:Publish",
      "Resource": "arn:aws:sns:REGION:ACCOUNT_ID:TOPIC_NAME",
      "Condition": {
        "StringEquals": {
          "AWS:SourceAccount": "ACCOUNT_ID",
          "AWS:SourceArn": "arn:aws:ses:REGION:ACCOUNT_ID:configuration-set/sendalto-WORKSPACE_ID"
        }
      }
    }
  ]
}

With feedback in place, a hard bounce or a complaint suppresses the address in Sendalto at once and cancels its queued emails. A complaint also pauses all sending in the workspace. The owner reviews what caused it and resumes sending in Settings → Workspace → Sending with Resume sending… (this needs two-factor sign-in and a recent sign-in). Complained addresses stay suppressed.

6. Request SES production access

New SES accounts start in the sandbox, where email goes only to verified addresses. In the SES console of your region open Account dashboard → Request production access and describe your use: permission-based lifecycle email, how people subscribe, and how you handle bounces, complaints and unsubscribes (Sendalto adds one-click unsubscribe to every marketing email). AWS usually answers within a day. Production access is granted per region.

7. Run the connection check

Choose Check connection on the Amazon SES card. Sendalto reads your SES account with the saved key and lists anything still missing under Check details. The connection is ready when every item below passes.

Sendalto repeats these checks before every send, and a check older than 24 hours must be run again before sending. Emails are sent from addresses at the sending domain itself: with example.com connected, use [email protected].

After the check passes

You can send test emails to your own address right away. Real sending to your audience also needs an approved business review by Sendalto and a paid plan or an early-access pilot. Plans are not on sale yet; during early access Sendalto offers free pilots to reviewed workspaces. See what works today.