Setting up Amazon SES with Newsletter Sender.

1Before you start

Ensure you have an AWS account with administrative access, along with the email address you plan to send from (such as news@yourdomain.com). If you haven't set these up yet, check the prerequisites guide first.

Amazon SES operates on a region by region basis. Choose a single region closest to the majority of your audience, and stick with it throughout this guide. Newsletter Sender supports:

1. In Newsletter Sender, go to Settings → Your company and check the From address. Amazon SES is set up for this address's domain, so set it first. Click Save if you changed it.

Choose how to set up Amazon SES

• Automatic setup wizard (recommended): create your AWS user and keys with one button (this also makes your S3 backup bucket), and Newsletter Sender verifies your sending domain, sets up bounce and complaint webhooks and adds the required DNS records directly to Cloudflare.
• Manual setup: configure AWS by hand if your AWS permissions restrict CloudFormation, or you prefer to create the user and keys yourself.

2Use the setup wizard

The wizard walks you through five quick, focused steps and handles the heavy lifting automatically. A progress bar at the top tracks your setup along the way.

1. Go to Settings → Sending and select Amazon SES.
2. Click Use the setup wizard to begin.

Step 1: Region

3. Select the AWS region closest to where most of your readers live, then click Next. For readers in the UK and Europe, Europe (Ireland) is typically best. Refer to the regions table in Before you start if you're unsure.

Step 2: Generate your AWS keys

4. Click Create the user and keys in AWS. AWS will open in a new browser tab with the required parameters pre-filled. Sign in with an administrator account if prompted. This automatically creates a restricted IAM user with permissions limited to Amazon SES and SNS (plus adding backup copies to S3), complete with a dedicated access key.

5. AWS will show the Quick create stack screen with all parameters pre-populated. Confirm that the Stack name reads newsletter-sender and that the AWS region in the top right corner matches the region you selected earlier. Leave all other parameters at their defaults.

6. Scroll to the bottom and check the box that reads I acknowledge that AWS CloudFormation might create IAM resources. AWS requires this confirmation whenever a template creates users.
7. Click Create stack.

8. Wait for the status to show CREATE_COMPLETE. This usually takes about a minute. If the status doesn't update on its own, click the circular refresh button.

9. Click the Outputs tab. You will see values for AccessKeyId, SecretAccessKey and Region. Keep this tab open, as you will need to copy these across to Newsletter Sender in the next step.

10. Switch back to the setup wizard in your Newsletter Sender tab. Copy and paste AccessKeyId into Access key ID, and SecretAccessKey into Secret access key. Be sure to highlight the exact text so no accidental spaces are copied over.
11. Click Check the keys and continue. The wizard checks your keys directly with AWS before going on. Your keys are encrypted securely within your own Cloudflare account and are never displayed again.

Step 3: Domain

The wizard automatically detects where your domain's DNS is hosted.

If your domain is on Cloudflare, Newsletter Sender can add the required DNS records automatically. It just needs an API token with DNS editing permissions:

12. Click Make a Cloudflare token. Cloudflare will open the Create API token page in a new tab, with the name Newsletter Sender DNS and all the permissions it needs already filled in. Sign in if prompted.
13. Under Zone Resources, select your sending domain. Limiting the token to this one domain means it can't see or change any of your other domains.
14. Click Continue to summary, then Create Token.
15. Click Copy next to the new token. Cloudflare won't show it again.
16. Return to the wizard, paste it into Cloudflare token and click Check the token and continue. Prefer to manage DNS yourself? Click I'd rather add the records myself.

If your DNS is hosted elsewhere, the wizard shows your provider (such as GoDaddy or Namecheap) and displays the exact records to copy across on the next screen.

17. Click Next to carry on.

Step 4: Set up

18. Click Set up Amazon SES. With a single click, Newsletter Sender:

• Adds and verifies your domain in Amazon SES with Easy DKIM email signing.
• Sends bounces to their own subdomain (bounce.yourdomain.com), keeping your main inbox clean.
• Sets up Amazon SNS to feed bounces and spam complaints back into Newsletter Sender automatically.
• Adds the required DNS records (DKIM, SPF and DMARC) automatically if your domain is on Cloudflare.
• Sends an automatic production access request to lift Amazon's SES sandbox limits.

19. If your DNS is hosted elsewhere, add each record shown on screen at your DNS host. Use the copy buttons next to each name and value. See DNS hosted elsewhere for tips.
20. Click Next.

Step 5: Final checks

21. Wait for the status to read You're ready to send. Amazon checks the DNS records automatically, usually within an hour. AWS typically reviews and approves production access requests by email within 24 hours. The wizard checks with AWS every 30 seconds, so you can leave the tab open, or close it and come back later.
22. Click Write your first email to begin drafting, or Done to return to your dashboard.

3What the wizard sets up

Here is a complete breakdown of what's created in your accounts. Nothing else in your accounts is changed or accessed.

In AWS (CloudFormation stack: newsletter-sender)

In Amazon SES

In Cloudflare (if your DNS is on Cloudflare)

4Manual setup

If your AWS permissions restrict CloudFormation, or you'd rather create the user and keys yourself, do it in the AWS IAM console. In Newsletter Sender, choose Amazon SES, then Set it up myself.

Part 1: Create a restricted IAM user

Newsletter Sender talks to Amazon through its own user, with only the permissions it needs. This user can't sign in to the AWS console.

1. Log in to the AWS Management Console and go to IAM → Users. Or type IAM in the top search bar and click Users in the sidebar.
2. Click Create user.

3. Enter a user name, such as newsletter-sender.
4. Leave Provide user access to the AWS Management Console unticked. Newsletter Sender only needs access through the API.
5. Click Next.

1. Under Permissions options, select Attach policies directly.
2. In the search box, search for AmazonSESFullAccess and press Enter. This lets it send email and manage your domain in SES.
3. Tick AmazonSESFullAccess. Tick the box at the start of the row, not the name (the name opens a new tab).

6. Now search for AmazonSNSFullAccess and tick it too. This lets Newsletter Sender hear about bounces and complaints straight away. The counter shows 2 chosen when both are ticked.
7. Click Next.

8. Review the summary screen and click Create user.

9. In the list of users, click your new user (newsletter-sender) to open its page.

Part 2: Generate access keys

1. On the user's page, select the Security credentials tab.

2. Scroll to Access keys and click Create access key. A brand new user has no access keys yet, so this box will be empty.

3. Under Use case, select Application running outside AWS. Newsletter Sender runs on Cloudflare, which is outside AWS.
4. Ignore the Alternative recommended notice and click Next. If you see a tick box under Confirmation, you've chosen a different option: go back and choose Application running outside AWS.

5. (Optional) Add a description, such as Newsletter Sender, to identify this key later.
6. Click Create access key.

7. Save your keys straight away. Copy the Access key (it starts AKIA), and click Show under Secret access key to copy it.
8. Click Download .csv file and keep it in your password manager. Then delete the download.

5Part 3: Connect your keys to Newsletter Sender

1. In Newsletter Sender, go to Settings → Sending, choose Amazon SES and select Set it up myself.
2. Select your AWS Region. Make sure it matches the region you used in AWS.
3. Paste your Access key ID and Secret access key into their boxes. Copy them cleanly from AWS so no stray spaces come across.
4. Click Save. Newsletter Sender checks the keys with AWS before saving. Your keys are stored encrypted inside your own Cloudflare account, and only the last few characters are ever shown again.

You'll see Sending through Amazon SES. Next, the DNS records.

6Add the DNS records

Amazon needs six DNS records on your domain before it lets you send. If your domain's DNS is on Cloudflare, Newsletter Sender can add them automatically using an API token. If your DNS is hosted elsewhere, see DNS hosted elsewhere below.

Option A: Your DNS is on Cloudflare

1. In Newsletter Sender, open Is your domain on Cloudflare? We can add the DNS records for you.
2. Click Make a Cloudflare token. Cloudflare's Create API token page opens in a new tab. Sign in if prompted.

3. The token is already named Newsletter Sender DNS with its permissions chosen. They let Newsletter Sender read your domain and manage its DNS records, nothing else. Leave them as they are.
4. Under Zone Resources, select your sending domain. Limiting the token to this one domain means it can't see or change any other domains in your Cloudflare account.
5. Click Continue to summary, then Create Token.
6. Click Copy next to the token. Cloudflare shows it only once. If you leave the page before copying it, you'll need to make a new one.
7. Return to Newsletter Sender, paste it into Paste the token and click Save. You'll see Your domain is on Cloudflare, so we add the DNS records for you.

8. Click Set up Amazon SES for me. It takes a few seconds.

That one button does all of this across your AWS and Cloudflare accounts:

• Adds your domain and DKIM signing in Amazon SES, so receiving email servers can check your messages come from your domain.
• Sends bounces to bounce.yourdomain.com, keeping them well away from your day to day inbox.
• Sets up Amazon SNS to send bounces and spam complaints straight back to Newsletter Sender, which stops emailing those addresses.
• Adds the DNS records to Cloudflare as DNS only (grey cloud), so Amazon can see them. A starter DMARC record is only added if your domain hasn't got one.
• Asks AWS to lift the sandbox with an automatic production access request (see below).

Option B: DNS hosted elsewhere

If your DNS is with a provider such as GoDaddy or Namecheap, click Set up Amazon SES for me without a Cloudflare token. It sets up the AWS side, then shows the exact records to add at your DNS host. Each name and value has its own copy button.

1. At your DNS host, add each record with the Type shown (CNAME, MX or TXT). Some hosts want only the part before your domain in the name box, such as bounce instead of bounce.yourdomain.com.
2. Copy the name from Newsletter Sender into your host's Name or Host box, and the value into Target, Points to or Value.
3. For the MX record on the bounce subdomain, set the priority to 10.
4. Add all six records, or five if your domain already has a DMARC record. Always keep your existing DMARC policy.

7Check it's working

1. In Newsletter Sender, click Check where it's up to. Amazon checks the DNS records automatically, usually within an hour. You can click it again at any time for a live status check.
2. Make sure each line shows a green tick: your domain can send, Signing (DKIM): success and Bounce address: success.

The last two lines show whether you're still in the Amazon SES sandbox and how fast you can send. New AWS accounts start at 1 email a second and 200 a day, and can only send to addresses you've verified.

8Leave the SES sandbox

Every new Amazon SES account starts in the sandbox. The setup (the wizard or Set up Amazon SES for me) sends the production access request for you, filling in the details:

A person at AWS reviews it and replies by email, usually within 24 hours. You don't need to do anything else. Once you're approved, click Check where it's up to: the sandbox line turns green and your sending speed goes up.

Requesting production access yourself

Only if Newsletter Sender shows We couldn't ask Amazon to take you out of the sandbox. Make sure the AWS console is set to the same region you chose at the start.

1. Go to Amazon SES → Account dashboard. Check the region at the top right matches yours, and that the banner says Your Amazon SES account is in the sandbox.

2. Click Request production access. It's on the dashboard, or under Get set up in the sidebar. You can also go straight to the request form.
3. Under Mail type, select Marketing.
4. In Website URL, enter the site where readers subscribe, so AWS can see what you send.
5. In the use case description, describe how you send, such as confirmed opt in sign ups, one click unsubscribes and automatic bounce handling.
6. Tick I agree to the AWS Service Terms and Acceptable Use Policy. You're confirming you only send to people who opted in.
7. Click Submit request.

9Troubleshooting

Need help? Get in touch with the status messages or errors you see. For your security, never share your secret access key or Cloudflare tokens.