Amazon SES SMTP Settings

Amazon's pay-per-message email sending service, run from your AWS account.

Search for your email provider

Amazon SES mail settings

Outgoing mail (SMTP)

SMTP server

email-smtp.us-east-1.amazonaws.com

Port. STARTTLS

587

Port. SSL/TLS

465

Security

STARTTLS on 587/25 or SSL/TLS on 465/2465. Host is region-specific (swap us-east-1 for your region).

Incoming mail (IMAP)

IMAP

Not supported. This is a send-only service.

Incoming mail (POP3)

POP3

Not supported by this provider.

Sending limits & login

Daily send limit

Sandbox: 200 emails/day. Production: a per-account quota you request from AWS.

Authentication

Authenticate with dedicated SMTP credentials generated in the SES console, not your AWS access keys.

App password

Generate SMTP credentials under SES > SMTP settings > Create SMTP credentials.

Amazon SES is a send-only relay: there is no IMAP or POP inbox. Amazon runs a separate sending address for each of its 19 regions, and your SMTP credentials only work in the region you created them in, so swap us-east-1 for your own region or the sign-in is rejected.

Sending cold email? EmailChaser manages inboxes, warmup and deliverability for you.

Try EmailChaser free

Find the SMTP, IMAP and POP3 server settings for any email provider. Free, with no signup, every field copies with one click.

Amazon SES SMTP, IMAP and POP3 settings

Amazon SES is Amazon's own bulk and transactional email service, billed per message through your AWS account. Its SMTP credentials are not your AWS access keys: you generate a separate SMTP username and password, and they only work in the one AWS region that created them. Every new account also starts in a sandbox that will only deliver to addresses you have verified.

Amazon SES is a send-only relay, so there's no IMAP or POP3 inbox. You only configure the SMTP server above. Use the tool to copy each value into your app or script.

Checked against Amazon SES's own documentation: docs.aws.amazon.com. Ports and limits change, so check there too if something will not connect.

Amazon SES settings at a glance

One card with every server and port on it. Right click to save it, or share the page and this is the preview people see.

Amazon SES mail server settings. SMTP server email-smtp.us-east-1.amazonaws.com on port 587 STARTTLS or 465 SSL/TLS. Send-only service with no IMAP or POP3 inbox.

What to enter as your Amazon SES username and password

Wrong credentials, not a wrong port, are the usual reason a Amazon SES connection fails. These are the exact values to type.

Username

The SMTP user name shown when you create SES SMTP credentials (it looks like an AWS access key ID), not your AWS account email

Password

The SMTP password generated at the same moment in the SES console. It is not your AWS secret access key.

Get your smtp password

How to set up Amazon SES in a mail client

The exact path through Amazon SES's own settings, in order.

  1. 1

    Verify the address or domain you send from

    In the SES console at https://console.aws.amazon.com/ses/, choose Identities, then Create identity, and verify the domain or email address you will use in the From field.

  2. 2

    Request production access to leave the sandbox

    Go to Account dashboard, then View Get set up page, then Request production access. AWS Support provides an initial response within 24 hours.

  3. 3

    Create SMTP credentials

    Choose SMTP settings in the left navigation pane, then Create SMTP Credentials. Download the .csv, because the password is shown once and cannot be retrieved later.

  4. 4

    Use the endpoint for the same region

    The host is email-smtp.<region>.amazonaws.com, for example email-smtp.us-east-1.amazonaws.com. It must match the region where you generated the credentials.

  5. 5

    Connect on port 587 with STARTTLS

    Ports 25, 587 and 2587 use STARTTLS; ports 465 and 2465 use TLS Wrapper (implicit TLS). SES requires every connection to be encrypted.

What Amazon SES looks like filled in

Every mail client asks for the same handful of fields. Here they are with Amazon SES's values already in place.

Account settings: Amazon SES

Outgoing mail server (SMTP)

Server

email-smtp.us-east-1.amazonaws.com

Port

587

Encryption

STARTTLS

Authentication

Required

Username

The SMTP user name shown when you create SES SMTP credentials (it looks like an AWS access key ID), not your AWS account email

Password

The SMTP password generated at the same moment in the SES console. It is not your AWS secret access key.
Incoming mail server

IMAP / POP3

Not applicable. Amazon SES sends only, so there is no inbox to configure.

An illustration of the fields, not a screenshot of any one app. Field names differ slightly between Outlook, Apple Mail and Thunderbird; the values do not.

Amazon SES SMTP settings in Thunderbird

The outgoing server dialog with Amazon SES's details entered. Outlook and Apple Mail ask for the same four things under slightly different names.

Thunderbird SMTP Server settings for Amazon SES: server name email-smtp.us-east-1.amazonaws.com, port 587, connection security STARTTLS, authentication method normal password.

Which port should you use for Amazon SES?

STARTTLS on 587/25 or SSL/TLS on 465/2465. Host is region-specific (swap us-east-1 for your region).

587Recommended

STARTTLS

Starts as a plain connection, then upgrades to an encrypted one. The modern standard for sending.

465

SSL/TLS

Encrypted from the first byte. Widely supported and a good choice when 587 is blocked.

25Not supported

Plain SMTP

Meant for server-to-server relay. Home networks and cloud hosts block it, so do not use it to send from a client.

Why your Amazon SES connection is failing

The failures people actually hit with Amazon SES, and what fixes each one.

554 Message rejected: Email address is not verified. The following identities failed the check in region US-EAST-1

Verify the exact From, Sender and Return-Path address under Identities in the SES console, in the same AWS region you are sending from. Verification does not carry across regions.

535 Authentication Credentials Invalid

You are almost certainly pasting an AWS access key ID and secret access key. SES SMTP credentials are a separate pair created under SMTP settings, then Create SMTP Credentials.

454 Throttling failure: Daily message quota exceeded

A sandbox account stops at 200 messages per 24 hours. Request production access from the SES Account dashboard to raise the quota.

Connections to port 25 time out from an EC2 instance

EC2 throttles outbound port 25 by default. Switch to port 587 or 465, or submit the AWS request to remove email sending limitations.

554 Access denied: User <UserARN> is not authorized to perform ses:SendRawEmail on resource <IdentityARN>

The IAM user behind the SMTP credentials has no sending permission. Attach an AmazonSesSendingAccess policy allowing ses:SendRawEmail to that user or its group.

Amazon SES sending limits

Quotas are counted per recipient and are set separately for each AWS region; the sandbox also caps you at 1 message per second.

Per day

200 messages per 24 hours in the sandbox; raised on request once in production

Recipients per message

50 recipients per message, counting To, Cc and Bcc together

Max attachment

40 MB per message including attachments, measured after base64 encoding, when sending over SMTP

Amazon SES servers by region and plan

Amazon SES does not use one set of hostnames everywhere. Match the row to your account.

Region or planSMTPIMAPPOP3
US East (N. Virginia)email-smtp.us-east-1.amazonaws.comNot applicableNot applicable
Europe (Ireland)email-smtp.eu-west-1.amazonaws.comNot applicableNot applicable
Asia Pacific (Sydney)email-smtp.ap-southeast-2.amazonaws.comNot applicableNot applicable

Amazon SES quirks by mail client

Outlook

Outlook sends with your mailbox address in the From header, which SES rejects unless that exact address is a verified identity in the same region.

Sending cold email through Amazon SES

Sandbox: 200 emails/day. Production: a per-account quota you request from AWS. Authenticate with dedicated SMTP credentials generated in the SES console, not your AWS access keys.

Those caps make single-mailbox sending fine for personal mail but a poor fit for cold outreach at volume. Emailchaser spreads sending across warmed inboxes and manages deliverability, so you can scale without burning Amazon SES accounts.

Other smtp sending services

Setting up more than one mailbox? These sit in the same category as Amazon SES.

Common questions about Amazon SES SMTP settings

What are Amazon SES's SMTP settings?


Amazon SES's outgoing (SMTP) server is email-smtp.us-east-1.amazonaws.com. Use port 587 (STARTTLS) or 465 (SSL/TLS). STARTTLS on 587/25 or SSL/TLS on 465/2465. Host is region-specific (swap us-east-1 for your region). Sign in with the SMTP credentials Amazon SES issues you, not a mailbox address and password.

What is Amazon SES's IMAP or POP3 server?


Amazon SES is a send-only service, so it has no IMAP or POP3 inbox. You configure it as an outgoing SMTP server only.

Which port should I use for Amazon SES?


Use port 587 with STARTTLS wherever it's offered, it's the modern standard for authenticated sending. Port 465 with SSL/TLS is a solid alternative. Avoid port 25, which most networks block for client sending. Amazon SES's recommended value is above.

Why won't my Amazon SES SMTP connection work?


Check authentication first: Authenticate with dedicated SMTP credentials generated in the SES console, not your AWS access keys. Generate SMTP credentials under SES > SMTP settings > Create SMTP credentials. Then confirm the host, port and security method match exactly, a 587/SSL or 465/STARTTLS mismatch will fail to connect.

Can I send bulk or cold email through Amazon SES?


Not at scale. Sandbox: 200 emails/day. Production: a per-account quota you request from AWS. Providers throttle bursts to fight spam, so pushing cold email through one mailbox hits limits and wrecks deliverability. High-volume outreach belongs on dedicated infrastructure that spreads sending across warmed inboxes, which is what Emailchaser does.

Why do my SES SMTP credentials work in one AWS region but not another?


SES SMTP credentials are signed for a single region and are rejected everywhere else. If you send from Ireland and Virginia, you need two separate sets of credentials. Verified sender identities are also per region, so an address verified in one region counts as unverified in the next.

Can I use my AWS access key and secret as the SMTP username and password?


The access key ID does work as the SMTP username, but the secret access key does not work as the password. SES requires a password derived from that secret through a signing algorithm. The easiest route is to let the SES console generate both values for you.

How do I get out of the SES sandbox?


Open the SES console, go to Account dashboard, then View Get set up page, then Request production access. You state whether your mail is marketing or transactional, give your website URL, and confirm you handle bounces and complaints. AWS Support provides an initial response within 24 hours.

Ready to 10x your pipeline?

Send your first cold email campaign today.

Start my free trial
7-day free trial · Cancel anytime4.9/5 from 36 reviews