Connect AWS SES

Why Mally uses AWS SES

Rather than bundling its own sending infrastructure, Mally connects to your AWS SES account. This keeps your sending reputation entirely in your hands — your IP addresses, your domain history, your deliverability record. You are not sharing an IP pool with other Mally users.

AWS SES charges approximately $0.10 per 1,000 emails sent — paid directly to AWS, not Mally. At that rate, sending 500,000 emails per month costs around $50 in SES fees, which is dramatically cheaper than per-contact pricing from traditional ESPs.

You will need an AWS account. If you do not have one, create a free account at aws.amazon.com. AWS SES is available in multiple regions — pick the region closest to your users or clients for lowest latency.

Creating an IAM user with SES permissions

Do not use your AWS root account credentials with Mally. Create a dedicated IAM user with only the permissions needed to send email.

1. 1Log in to the AWS Console and go to IAM → Users → Create user
2. 2Give the user a descriptive name such as "mally-ses-sender"
3. 3On the permissions step, choose "Attach policies directly"
4. 4Search for and attach the policy: AmazonSESFullAccess (or create a custom policy — see below)
5. 5Complete the user creation, then go to the user's Security credentials tab
6. 6Click "Create access key" — choose "Application running outside AWS"
7. 7Download or copy the Access Key ID and Secret Access Key — you will not be able to view the secret again

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ses:SendEmail",
        "ses:SendRawEmail"
      ],
      "Resource": "*"
    }
  ]
}

Getting SMTP credentials

Mally connects to SES over SMTP. AWS SES SMTP credentials are different from your IAM access keys — you must generate them separately.

1. 1In the AWS Console, go to Amazon SES → SMTP settings
2. 2Note your SMTP endpoint — e.g. email-smtp.us-east-1.amazonaws.com — and port (465 for TLS, 587 for STARTTLS)
3. 3Click "Create SMTP credentials" (this creates a new IAM user automatically)
4. 4Download the credentials file containing your SMTP username and password

Keep these credentials safe. If you lose them, you will need to generate a new set from the SES console.

Adding SES credentials to Mally

Go to Console → Gateways → Add gateway. Select AWS SES as the gateway type and fill in:

• SMTP host: Your SES endpoint, e.g. email-smtp.us-east-1.amazonaws.com
• SMTP port: 465 (SSL/TLS) or 587 (STARTTLS). Use 465 unless your environment blocks it.
• SMTP username: The SMTP username from the credentials file (not your IAM access key ID).
• SMTP password: The SMTP password from the credentials file.
• Gateway name: A label for your reference, e.g. "Production SES US-East-1".

Save the gateway. Mally will send a test connection to verify the credentials. If the test fails, double-check that your SES account has been moved out of sandbox mode (see next section).

Verifying your sending domain

SES will only send from domains you have verified. Go to Amazon SES → Verified identities → Create identity and select Domain. Enter your sending domain (e.g. mail.yourdomain.com) and enable Easy DKIM.

AWS will provide three CNAME records for DKIM. Add these to your DNS. Once propagated (usually 5–30 minutes), the identity will show as "Verified" in the SES console.

Setting up bounce and complaint SNS webhooks

Mally automatically suppresses bounced and complained addresses — but only if you wire up the SNS notifications from SES. This is critical for list hygiene and protecting your sender reputation.

1. 1In the AWS Console, go to Amazon SNS → Topics → Create topic. Name it "mally-ses-bounces". Create a second topic named "mally-ses-complaints".
2. 2Go to Amazon SES → Verified identities → select your sending domain → Notifications tab
3. 3For "Bounces", select the "mally-ses-bounces" SNS topic. For "Complaints", select "mally-ses-complaints".
4. 4Back in SNS, go to each topic → Subscriptions → Create subscription. Set Protocol to HTTPS.
5. 5For the endpoint, use your Mally webhook URL: your-domain.com/api/webhooks/ses/bounces (and /complaints for the complaints topic).
6. 6AWS will send a confirmation request to the endpoint. Mally automatically confirms it — check Console → Gateways to confirm both webhooks show as "Active".

Once active, hard bounces and spam complaints are recorded against the subscriber and suppressed from future sends automatically.

Testing with a campaign

With credentials saved and your domain verified, send a test campaign to confirm everything is wired up. Create a test list with your own email, build a minimal campaign, and click Send now. Check:

• Email arrives in inbox (not spam)
• DKIM signature shows as valid (check "Show original" in Gmail → look for dkim=pass)
• Unsubscribe link in the footer works
• SES sending statistics in the AWS console show the message as delivered

If delivery fails, check Console → Logs for the error message. The most common issues are expired sandbox mode, wrong SMTP credentials, or DNS records not yet propagated.