Amazon SES SMTP settings: email-smtp.<region>.amazonaws.com, port 587/465
Amazon SES SMTP interface: endpoint email-smtp.us-east-1.amazonaws.com (per region), ports 25/587/2587 STARTTLS or 465/2465 TLS, SMTP credentials generated from IAM (not your access keys). Sandbox limits, pricing and common errors.
Amazon SES outgoing mail server:
email-smtp.<region>.amazonaws.com,, port <code>587</code> (STARTTLS) or <code>2587</code> (STARTTLS) or <code>465</code> (SSL/TLS) or <code>2465</code> (SSL/TLS) or <code>25</code> (STARTTLS), username = the SMTP username generated in SES → SMTP settings → Create SMTP credentials (an IAM user's access key ID), password = the derived SMTP password shown once at creation.
Amazon SES SMTP settings at a glance
| Outgoing (SMTP) host | email-smtp.<region>.amazonaws.com, e.g. email-smtp.us-east-1.amazonaws.com, email-smtp.eu-west-1.amazonaws.com |
|---|---|
| Ports & encryption |
587 — STARTTLS <em>(recommended)</em>2587 — STARTTLS <em>(when 587 is blocked)</em>465 — SSL/TLS2465 — SSL/TLS25 — STARTTLS <em>(EC2 throttles port 25 unless you request removal)</em> |
| Username | the SMTP username generated in SES → SMTP settings → Create SMTP credentials (an IAM user's access key ID) |
| Password | the derived SMTP password shown once at creation (it is NOT the IAM secret access key) |
| Authentication | SES SMTP passwords are derived from an IAM secret with a region-specific signature; the console generates them. Credentials are tied to the region of the endpoint. |
How to set up Amazon SES SMTP
- SES console → Verified identities → create a domain identity → add the DKIM CNAMEs to DNS.
- SES console → SMTP settings → Create SMTP credentials → download the username and password.
- App settings: host email-smtp.<region>.amazonaws.com, port 587, STARTTLS, username/password = SMTP credentials.
- Request production access (Account dashboard → Request production access) before sending to unverified recipients.
Sending limits
- Sandbox accounts: 200 messages per 24 hours, 1 per second, and only to verified addresses/domains — request production access to lift it.
- Production quotas start around 50,000 per day and scale with reputation; bounce rate over 5% or complaint rate over 0.1% puts the account under review.
- Every From domain (or address) must be verified in SES; DKIM via Easy DKIM CNAMEs.
- Pricing: $0.10 per 1,000 emails (plus data), free tier for EC2-originated mail on some plans.
Things that catch people out
- Using the IAM secret key as the SMTP password is the most common SES mistake — it must be the derived SMTP password.
- Credentials and identities are per region.
Common Amazon SES SMTP errors
| Server reply | Meaning | Fix |
|---|---|---|
535 Authentication Credentials Invalid | IAM secret used, wrong region, or missing ses:SendRawEmail permission. | Generate SMTP credentials in the console for that region. |
554 Message rejected: Email address is not verified | Sandbox and unverified recipient/sender. | Verify the identity or request production access. |
454 Throttling failure: Maximum sending rate exceeded | Per-second rate exceeded. | Slow down; SES quotas grow with volume. |
More codes: 535 authentication failed, 550 relay denied, 554 rejected as spam, connection timed out — or all SMTP error codes.
When Amazon SES is not enough for your app
When a provider caps you or blocks a port, point the same app at QueenSMTP instead: host smtp.queensmtp.com, port 587 (STARTTLS) or 465 (SSL), your SMTP username and password from the dashboard. $5/year plus $0.10 per 1,000 emails, 100 free a day to test.
Get SMTP credentials — free to test Test Amazon SES nowRelated settings
Amazon SES SMTP — questions
email-smtp.
Because the SMTP password is not your IAM secret access key: it is a derived password the SES console generates, per region.
Related Guides
Continue learning with these related articles