Building a Large-Scale Email Delivery Platform with Amazon SES - Optimizing Deliverability and Managing Sender Reputation
This article explains email sending configuration with SES, DKIM/SPF authentication, bounce and complaint handling, and sender reputation management.
Overview of SES
SES is a cloud-based service for sending and receiving email at scale. It is used to send transactional email (order confirmations, password resets), marketing email (newsletters, campaigns), and notification email (alerts, reports). Pricing was revised to a pricing-plan model (Essentials / Pro / Enterprise) on July 21, 2026, and new accounts now start on the Essentials plan (unit prices are in the "SES Pricing" section below). SES supports both the SMTP interface and the AWS SDK as sending protocols. Through the SDK, you use SendEmail in the current-generation SES API v2, which switches between simple / raw / template with content (in the older-generation v1, SendEmail and SendRawEmail were separate APIs). You use SMTP when migrating from an existing mail system and the SDK when building it into a new application. SES infrastructure is operated in multiple AWS Regions, and a separate sending reputation is managed for each Region.
Deliverability and Sender Reputation
To increase email deliverability, DKIM, SPF, and DMARC authentication settings are mandatory. SES automatically applies 2048-bit DKIM signatures with Easy DKIM (2048 bits is the default in both the API and the console), and passes SPF authentication with a custom MAIL FROM domain. Publishing a DMARC policy in DNS protects your domain from spoofed email. Sender reputation management is considered in terms of two levels of thresholds. At a bounce rate of 5% or more or a complaint rate of 0.1% or more, the account is placed under review. At a bounce rate of 10% or more or a complaint rate of 0.5% or more, sending is temporarily paused. Account status is shown in the stages Healthy / Under review / Pending end of review decision / Sending paused / Pending sending pause. For this reason, exceeding 5% or 0.1% does not mean an immediate pause in sending, but if you cannot make improvements during the review period, the account moves on to a pause. SES displays bounce and complaint rates with the reputation metrics on the account dashboard, and can notify you with CloudWatch alarms when the rates approach the thresholds. You build a workflow that receives bounces and complaints in real time through SNS notifications and automatically removes the addresses from the sending list with Lambda. Bounces include hard bounces (nonexistent recipient) and soft bounces (full mailbox, etc.); hard bounces are added to the suppression list immediately, and soft bounces are judged after retries.
- 1. MonitoringThe bounce rate and complaint rate are checked on the dashboard. When they approach the thresholds (bounce rate 5%, complaint rate 0.1%), a CloudWatch alarm sends a notification.
- 2. ReceivingBounces and complaints are received in real time through SNS notifications.
- 3. RemovalLambda automatically removes the matching addresses from the sending list.
- 4. SortingHard bounces (nonexistent recipient) go to the suppression list immediately. Soft bounces (full mailbox, etc.) are judged after retries.
Templates and Receipt Rules
SES email templates embed dynamic content with Handlebars syntax, and SendBulkEmail in SES API v2 (SendBulkTemplatedEmail in the older-generation v1) sends large volumes of personalized email in bulk. Receipt rule sets automate the processing of incoming email, and you can configure saving to S3, running Lambda, notifying SNS, and integration with Amazon WorkMail. Virtual Deliverability Manager visualizes the deliverability of outgoing email on a dashboard and provides recommendations for improving bounce and complaint rates. Configuration sets deliver email sending events (send, delivery, bounce, complaint, open, click) to CloudWatch, Amazon Data Firehose, Amazon EventBridge, and SNS to run sending analysis (Amazon Data Firehose is the service that was called Kinesis Data Firehose until February 2024).
SES Pricing
(As of August 2026 / N. Virginia and Tokyo) SES pricing was revised to a pricing-plan model on July 21, 2026, and there are now two tracks: pricing plans and the traditional pay-as-you-go pricing. There are three pricing plans: Essentials / Pro / Enterprise. Essentials has no fixed monthly fee and costs $0.16 per 1,000 emails sent. The price per 1,000 emails falls to $0.14 for emails beyond the first 10 million per month and to $0.11 for emails beyond the first 100 million (the same price in N. Virginia and Tokyo). Pro costs $0.22 per 1,000 emails sent ($0.17 for more than 10 million emails, $0.12 for more than 100 million emails) plus $105 per month for each combination of account and Region. The plan includes managed dedicated IPs and Virtual Deliverability Manager. Enterprise is $0.23 per 1,000 emails ($0.18 for more than 10 million emails, $0.13 for more than 50 million emails) + $500 per month. Combinations of account and Region with no SES billable usage since June 1, 2025 start on the Essentials plan from July 21, 2026 onward. Pay-as-you-go is a path that existing accounts using SES since before the revision can continue to choose, at $0.10 per 1,000 emails sent (the unit price does not change depending on whether the sender is EC2). SES's own free tier was 3,000 message charges per month for 12 months from the start of use, but it is not offered to new customers from July 21, 2026 onward and has been merged into AWS Free Tier credits. Attachments are charged at $0.12 per GB regardless of the plan. There are two kinds of dedicated IPs, and standard dedicated IPs cost $24.95 per IP per month. Managed dedicated IPs follow a separate pricing structure of $15 per account per month + $0.08 per 1,000 emails sent ($0.04 for more than 10 million emails, $0.02 for more than 50 million emails, $0.004 for more than 100 million emails). Virtual Deliverability Manager costs $0.02 to $0.07 per 1,000 emails sent on the pay-as-you-go path. On the Essentials and Pro plans, it can be used at no additional cost (Global sending monitoring, which monitors domains even outside SES, is a separate subscription at $1,250 per month). Receiving is charged as email processing in Mail Manager, and its volume tiers are applied independently of sending. On the pay-as-you-go path, the processing price is $0.15 per 1,000 emails in both N. Virginia and Tokyo (as of August 2026). If you use archiving, storage in Tokyo costs $0.19 per GB per month and a dedicated ingress endpoint costs $50 per month, both charged separately.
Design Best Practices and Pitfalls
This section summarizes the design points that come up frequently when running SES in production and the pitfalls that are easy to overlook. Managing suppression lists is the most important point. In addition to the account-level suppression list, the application keeps its own suppression list to completely prevent re-sending to addresses that have bounced. Using dedicated IPs requires a warm-up, and if you choose managed dedicated IPs, SES proceeds with the warm-up automatically while watching sending volume. If you manage standard dedicated IPs yourself, you raise sending volume gradually per the official documentation's warm-up plan (the needed period and pace vary with target volume and receiver response, so a fixed number of days cannot be set). By setting the event destination of a configuration set to Amazon Data Firehose and accumulating logs in S3, you can analyze long-term trends in deliverability. In sandbox mode, you can send only to verified addresses or domains (and the mailbox simulator), and a limit of 200 emails per 24 hours / 1 email per second applies. For this reason, you submit a request to lift the sending limits before moving to production. The first response from Support usually comes within 24 hours, and if AWS needs additional checks, approval takes even longer. Sandbox status is independent for each Region, so a request is required each time you add a sending Region. For DMARC policy, it is safe to monitor with p=none first, analyze the reports, and then strengthen it gradually to p=quarantine or p=reject.
Comparison with Other Email Delivery Services
This section compares SES with other means of email delivery. Unlike SendGrid and Mailgun, SES has the strength of native integration with the AWS ecosystem (Lambda triggers, S3 storage, CloudWatch metrics). On the other hand, SendGrid has a full set of features such as a GUI editor for marketing templates and A/B testing. Compared with on-premises Postfix / SMTP relays, SES automates IP reputation management and bounce processing, so the operational burden drops significantly. Amazon Pinpoint, once an option for email delivery, stopped accepting new customers on May 20, 2025, and its end of support is scheduled for October 30, 2026. AWS recommends migrating to SES for email sending, and for engagement features such as endpoints / segments / campaigns / journeys, AWS guides users to migrate to Amazon Connect outbound campaigns. Therefore, in a new design, both transactional email and marketing email are sent with SES, and segment management and delivery scheduling are handled on the application side or the Amazon Connect side. SNS Email subscriptions are meant for simple notifications, and you use them only for notifications that need neither HTML templates nor bounce management.
Summary
Adopting SES starts with sending tests in sandbox mode and moves to production operation after a request to lift the sending limits. To maintain deliverability, DKIM and SPF authentication settings, building a processing flow for bounces and complaints, and monitoring of sending reputation are essential. The basic policy is to take action on the bounce rate and complaint rate before they reach the review thresholds (5% / 0.1%). You track deliverability trends on the Virtual Deliverability Manager dashboard and detect signs of problems early. For high-volume sending, you isolate reputation with dedicated IP addresses and increase sending volume gradually through a warm-up (if you choose managed dedicated IPs, you can leave the warm-up to the automatic control on the SES side).
References (Official AWS Resources)
The primary sources for this page are the official AWS website and documentation. Check the official pages below for the latest specifications and pricing.
- Amazon SES official page
- Amazon SNS official page
- AWS Lambda official page
- AWS Documentation (official)
If this page and the official documentation disagree, treat the official documentation as authoritative.