Skip to content

Amazon SES

Amazon SES (Simple Email Service) is AWS's high-volume transactional email service — verified sending domains, uncapped external recipients, and per-second/per-day quotas that scale with your account. pg_relay reaches it through the SMTP transport: SES publishes a dedicated SMTP endpoint authenticated with static credentials, which is exactly the shape auth: plain already speaks. No OAuth2, no new configuration concepts.

Why not the SES REST API?

Every request to SES's native API must be SigV4-signed — AWS's HMAC request-signing scheme, computed over the request body and timestamp. That is a cryptographic subsystem of its own, not a static credential the webhook transport's auth styles could carry, so the API path is deliberately not used. The SMTP endpoint reaches the same sending infrastructure, the same verified identities, and the same quotas — nothing meaningful is lost.

Profile

{
  "host": "email-smtp.ap-southeast-2.amazonaws.com",  // your SES region
  "port": 587,
  "security": "starttls",
  "auth": "plain",
  "username": "AKIAIOSFODNN7EXAMPLE",                 // SES SMTP username
  "password": "_env:SES_SMTP_PASSWORD",               // SES SMTP password
  "from": "[email protected]",                    // a verified SES identity
  "timeout_seconds": 30
}
  • Host — email-smtp.<region>.amazonaws.com, using the region your SES identities live in. Port 587 with starttls is the standard pairing; SES also answers on 465 with security: tls.
  • Credentials — generated once in the SES console under SMTP settings → Create SMTP credentials. These are SMTP credentials, derived from an IAM user — static, and not the IAM user's own access key and secret. Keep the password out of the database with an _env: reference, as always (Keeping Secrets Out of the Database).
  • from — must be an identity (an address or a whole domain) you have verified in SES for that region.

Message

The standard message block, exactly as the SMTP chapter describes it — to/cc/bcc, subject, body_text/body_html (both together sends multipart/alternative), and attachments.

Things SES enforces

  • Sandbox mode. A new AWS account starts in the SES sandbox, where you can only send to verified addresses. Request production access in the SES console before pointing real traffic at it.
  • Identity verification. An unverified from is rejected by SES with a 5xx reply — a permanent failure in pg_relay's classification, resolved immediately with no retry. Verify the identity, then re-send.
  • Sending quotas. Exceeding your per-second rate draws a 4xx throttling reply — transient, handled by the normal retry chain automatically.

Continue to SendGrid.