Skip to content
Sending & Deliverability

How to Set Up Amazon SES with AcelleMail

Create an IAM user and access key in AWS, connect Amazon SES to AcelleMail, share your verified domains with users, and let them verify their own.

Email Deliverability Editor
Updated on:
10 min read Intermediate

AcelleMail is a self-hosted email marketing application written in PHP and Laravel. It manages contacts, campaigns, automation, sending queues, and reporting, while the actual email delivery is handled by a separate sending service.

Amazon SES is one of the services that can be used for email delivery. AcelleMail supports both the Amazon SES API and SMTP. This guide focuses on the SES API because it also allows AcelleMail to manage sending identities and configure bounce and complaint notifications.

The setup has three main parts:

  1. Create an AWS IAM user and access key.
  2. Add Amazon SES as a sending server in AcelleMail.
  3. Configure the sending domains and SES settings.

Once the sending server is connected, AcelleMail can also configure the SES resources it needs for bounce and complaint handling.

1. Create an AWS IAM user

AcelleMail needs AWS credentials to connect to Amazon SES.

It is better to create a dedicated IAM user for AcelleMail instead of using the AWS root account credentials. A dedicated user can be disabled or have its access keys rotated without affecting other AWS services.

In the AWS console, open IAM.

Searching for IAM in the AWS console

Go to IAM → Users and click Create user.

You can use a name such as:

acellemail-ses

The user does not need console access because AcelleMail will use its access key to access AWS.

The IAM users list with the Create user button

Attach the required permissions

On the permissions step, choose Attach policies directly.

Attach these three AWS managed policies:

Policy Used by AcelleMail for
AmazonSESFullAccess Sending email and managing SES identities
AmazonSNSFullAccess Creating and configuring the SNS resources used for bounce and complaint notifications
IAMReadOnlyAccess Checking the AWS credentials and permissions when you use Test Connection

IAM user with AmazonSESFullAccess, AmazonSNSFullAccess and IAMReadOnlyAccess attached

These policies provide broader permissions than a custom least-privilege policy. If the AWS account is dedicated to AcelleMail, this can be a practical setup. If the account also contains other production resources, consider creating a more restricted IAM policy instead.

Create an access key

Open the IAM user's Access keys section and click Create access key.

The Access keys section of the IAM user with the Create access key button

When AWS asks what the key will be used for, choose Third-party service.

Choosing Third-party service as the access key use case

AWS will then show the Access key and Secret access key.

Save both values. AWS only shows the secret access key when it is created. If you lose it later, create a new key and deactivate the old one.

The Retrieve access keys screen

AcelleMail stores the AWS credentials in its database because it needs to access SES without user interaction. The AWS secret access key is encrypted at rest.

You should still use a dedicated IAM user, limit its permissions where practical, and rotate its access keys periodically.

2. Add Amazon SES to AcelleMail

Once you have the AWS access key, add it to AcelleMail.

Log in to AcelleMail as an administrator and open:

Sending → Sending Servers

The admin dashboard with Sending Servers in the left menu

Click Add Server and select:

Amazon Web Service API

The Choose Server Type window with Amazon Web Service API selected

AcelleMail also supports Amazon Web Service SMTP. The SMTP option requires SES SMTP credentials, while the API driver uses the AWS access key directly.

For this setup, we recommend the Amazon Web Service API driver.

Under Connection details, enter:

  • AWS Access Key ID
  • AWS Secret Key
  • AWS Region

The region is important because Amazon SES identities and quotas are regional.

The New server form with AWS Access Key ID, AWS Secret Key and AWS region

Click Save Changes.

Test the connection

After saving the server, AcelleMail provides two useful tests.

Test Connection checks the AWS credentials and the permissions required by AcelleMail.

Send Test Email sends an actual email through Amazon SES.

Use Test Connection first. If it reports a permission problem, fix the IAM permissions before testing email delivery.

If the SES account is still in the sandbox, the test recipient must be a verified email address.

The saved sending server showing Test Connection and Send Test Email

If you are running AcelleMail with multiple users or plans, also make sure the sending server is assigned to the appropriate plan. A correctly configured sending server will not send anything if no plan or user is allowed to use it.

3. Bounce and complaint notifications

AcelleMail uses Amazon SNS to receive bounce and complaint notifications from SES.

When the SES sending server is connected, AcelleMail creates the required SNS topic and subscription automatically.

This allows AcelleMail to receive notifications from SES and associate them with the corresponding contacts. Contacts affected by hard bounces or complaints can then be excluded from later campaigns.

There is one important requirement: your AcelleMail installation must be publicly accessible.

SNS needs to send notifications to an endpoint on your AcelleMail installation. A localhost address, private IP address, or VPN-only hostname cannot receive these notifications from AWS.

Make sure APP_URL points to the public URL of your AcelleMail installation before enabling the SES server.

If this is not configured correctly, email sending may still work, but bounce and complaint notifications will not be processed.

4. Share verified sender identities

Every email sent through SES must use a verified sender identity.

If you have already verified domains in Amazon SES, you can manage them from the AcelleMail sending server:

Advanced → Sender Identity

The list shows the SES identities available in the selected region.

Sender Identity rows with the Available for all checkbox and the Owner dropdown

You can make a verified domain available in two ways.

Available for all

Enable Available for all if all users on the AcelleMail installation should be able to send from that domain.

Assign to a user

Alternatively, set an Owner for the identity. The selected customer will then be able to use that domain.

Only identities with an Active status can be used for sending.

If an identity is marked Failed, the problem needs to be fixed in Amazon SES or DNS before it can be used.

Once a domain is available to a user, it appears in the campaign's From email field under Verified senders.

The From email dropdown in a campaign showing a shared domain under Verified senders

5. Add customer sending domains

In a multi-user AcelleMail installation, customers will usually want to send from their own domains.

A customer can add a domain from:

Sending domains → Add domain

The Sending Domains page with the Add domain button

When the customer's account uses the Amazon SES sending server, AcelleMail registers the domain with SES and displays the DNS records that need to be added.

The domain page shows a Synced · Amazon SES status and the required records.

The DNS records AcelleMail shows for a domain synced with Amazon SES

The records normally include:

  • Domain identity — a TXT record at _amazonses.theirdomain.com
  • DKIM — three CNAME records ending in .dkim.amazonses.com
  • SPF — a TXT record containing v=spf1 include:amazonses.com ~all

After publishing the records, click Verify DNS records in AcelleMail.

DNS changes can take some time to propagate, so the verification can be run again later.

Two common DNS problems

Do not create multiple SPF records

A domain should have one SPF record.

If the domain already has an SPF record for Google Workspace or another email service, add the Amazon SES include to the existing record instead of creating a second SPF record.

For example:

v=spf1 include:google.com include:amazonses.com ~all

Multiple SPF records can result in a permerror and cause SPF validation to fail.

Check how your DNS provider handles record names

Some DNS providers automatically append the domain name to the host field.

For example, entering:

_amazonses.theirdomain.com

may result in:

_amazonses.theirdomain.com.theirdomain.com

If the SES identity remains in Pending, check the actual DNS record rather than relying only on what is shown in the DNS control panel.

You can check the TXT record with:

dig +short TXT _amazonses.theirdomain.com

And a DKIM record with:

dig +short CNAME <selector>._domainkey.theirdomain.com

6. SES sandbox, quotas and regions

There are three Amazon SES settings you should check before sending a real campaign.

SES sandbox

New SES accounts start in the sandbox, and the restriction applies per region.

In the sandbox:

  • recipients generally need to be verified
  • the sending limit is 200 messages per 24 hours
  • the sending rate is 1 message per second

To request production access, open the SES Account dashboard and choose Request production access.

The review is asynchronous, so it is worth requesting production access while you are configuring your domains and AcelleMail.

Sending quotas

Production access does not mean that every AWS account has the same sending quota.

SES sets sending quotas per account and region. Check the current quota in the AWS Account dashboard and use that value when configuring sending limits in AcelleMail.

Do not assume that a commonly quoted quota such as 50,000 emails per day applies to your account.

AWS regions

SES identities and sending quotas are regional.

For example, if you verified a domain in:

us-east-1

but configured AcelleMail to use:

eu-west-1

the verified identity will not appear in the AcelleMail server's Sender Identity list.

Make sure the region used by AcelleMail is the same region where your SES identities are configured.

7. Common problems

What you see What it usually means
Action ses:... is not allowed / sns:... The IAM user is missing a required permission
The security token included in the request is invalid The access key is incorrect, truncated, or deactivated
Email address is not verified The SES account is still in the sandbox for that region
AWS SNS will not be able to reach it… APP_URL is not publicly accessible
Sender Identity list is empty The AcelleMail server region does not match the SES region
Customer domain remains Pending The DNS record may have been entered incorrectly or DNS has not propagated
This domain is already registered on the system sending server… The domain was already registered in SES and needs to be assigned through Sender Identity

Summary

To connect AcelleMail to Amazon SES:

  1. Create a dedicated AWS IAM user.
  2. Give it the permissions required by AcelleMail.
  3. Create an AWS access key.
  4. Add the credentials to an Amazon Web Service API sending server in AcelleMail.
  5. Use Test Connection before sending a campaign.
  6. Make sure APP_URL is publicly accessible so SNS can deliver bounce and complaint notifications.
  7. Verify your sending domains and publish the required DNS records.
  8. Keep the SES region consistent between AWS and AcelleMail.
  9. Check your actual SES sending quota before configuring sending limits.

Tagged

13 comments

9 comments

  1. Isabella
    the postmaster tools section is gold. most senders don't even know it exists.
    1. Admin
      Needs roughly 100 messages a day to Gmail before the charts show anything, so people set it up, see blank, and assume it's broken.
  2. Mai
    We hit a Spamhaus listing once. Self-service delisting was actually fast (< 24h) but the reputation recovery took weeks. Not the listing itself that hurt — the user complaints that caused it
  3. Ravi
    for very low-volume senders (< 5k/month), does warmup evn matter? or just send and let the providers shared pool absorb the trickle?
    1. Admin
      At 5k/month on SES you're on their shared IP pool by default, and IP warmup is a dedicated-IP concept. You can't meaningfully warm a shared pool, so no, don't bother. AWS does its own ramp anyway: out of sandbox you typically start at 50k/day and 14 emails/sec, and the quota lifts as you send clean. What still matters at your volume is domain reputation, which warmup doesn't fix. Get DKIM, SPF and a DMARC record on the sending domain, keep bounces under 5% and complaints under 0.1%, or SES puts the account under review regardless of how slowly you sent. Set up the SNS bounce/complaint topics and point them at AcelleMail's webhook so those get recorded instead of silently accumulating on the AWS side. Only revisit warmup if you buy a dedicated IP, and at 5k/month you shouldn't. A dedicated IP needs steady volume to hold a reputation, and a trickle on your own IP is worse than a trickle on Amazon's.
  4. Carlos
    This is the clearest IP warmup schedule I've found. The volume table at the top is what I'm referencing daily.
  5. Olufemi
    Does engagement-based segmentation help during warmup? E.g. only sending to the most-engaged 20% during week 1?
    1. Admin
      Yes, and it's probably the single highest-leverage thing you can do during an SES warmup. SES raises your quota based on how the receivers react, so week 1 volume going to people who actually open and click is what buys you the bounce and complaint rates that make the increase automatic. Sending the same volume to your cold tail gets you the volume without the reputation. The shape I'd use: week 1 to the last 30 days of openers, week 2 widen to 90 days, then unengaged-but-not-stale, then everything. Roughly double per step and don't jump ahead just because SES bumped your quota. The quota is permission, not a recommendation. One SES-specific caveat for this article. Your sandbox sends don't count for any of this, the reputation clock effectively starts at production mode with real recipients, so don't treat verified-identity test sends as warmup progress. If you want it enforced rather than done by hand, the warmup module handles the daily ramp but it does not pick the audience for you. You'd still build the engagement segment on the list side and point the campaign at it. Segment-aware warmup is something I want to do, but it's not there today.
  6. Joel
    If you're warming a new IP after a known issue, consider seeding with transactional mail first (password resets, order confirmations). Higher engagement rate per send than marketing — helps the reputation ramp.
  7. Vera
    we warmed up a dedicated ip last fall. the 2-week ramp this article describes is on the aggressive side — gmail in particular punishes anything faster than ~3-4 weeks. we did 4 weeks and had a clean ramp.
  8. Akira
    Confirming the Postmaster Tools data lag — sometimes 48 hours, sometimes longer. Don't make decisions on a single day's data.
    1. Admin
      That matches what we see. Postmaster Tools usually backfills a day or two late, and low-volume domains get gaps where a day just never populates because it fell under Google's reporting threshold. Rolling 7-day is the only view worth reacting to. Worth saying that the SES side moves on a different clock. Bounce and complaint rates in the SES console update within minutes of the feedback event, so if you're watching for a sending pause that's the number to watch, not the Google spam rate. They tell you different things and people conflate them. I'll add a note about the lag to the reputation section of the article.
  9. Brian
    Bookmarked. Going to share with the team — we've been winging warmup and it shows in the numbers.

Related reading

More in Sending & Deliverability

Run your email marketing on your own server, your own terms

Join thousands of companies that have taken control of their email marketing with full source code, no recurring fees, and unlimited sending. One-time $80 license, 1 year of updates and 6 months of support.

Get the AcelleMail newsletter

Monthly issue with new releases, deliverability tips, and self-hosting playbooks. No spam.