Email with Amazon SES

Words you’ll see

IAM user

In AWS, a separate login made for one purpose, with only the permissions you give it. Your own (root) login can do everything, so it should never be handed to any service.

Policy

A short list of what a user or key is allowed to do, written as JSON. You paste the one from the guide; it allows only what Claspine needs.

Access key ID and secret access key

A pair of values that works like a username and password for programs. The ID can be shown; the secret is shown once when you create it.

Region

The part of the world where the provider runs your service, such as us-east-1 (Virginia) or europe-west4 (Netherlands). Use the region where you set things up.

DKIM

A signature on every email that proves it really comes from your domain. You turn it on by adding the DNS records SES gives you; without it, mail lands in spam.

Before you start

• An AWS account.
• A domain you control (for example yourshop.com) and access to its DNS settings.

Steps

1. Sign in to the Amazon SES console and choose the region you want to send from (top right), for example eu-west-1. Note it; Claspine needs it.
2. Verify your domain. Open Configuration → Identities → Create identity, choose Domain, enter your domain, keep Easy DKIM (RSA 2048) and create it. SES shows three CNAME records: add them at your DNS provider. (Claspine’s Check shows the same records.) SES marks the domain verified after it sees them, usually within an hour.
3. SPF and DMARC. Gmail and Yahoo require them from bulk senders. Add a TXT record _dmarc.yourshop.com with v=DMARC1; p=none;. SES signs with DKIM, which satisfies alignment; if you also set a custom MAIL FROM domain, follow the SPF record SES shows.
4. Leave the sandbox. Open Account dashboard → Request production access: mail type Transactional, your website, and one or two sentences on what you send and to whom. AWS usually answers within a day.
5. Create a key for Claspine. Open IAM → Users → Create user named claspine-messaging, without console access. Open the user → Permissions → Add permissions → Create inline policy → JSON, paste the policy below and save. Then Security credentials → Create access key (“Application running outside AWS”) and copy both values.
6. In the Claspine console open Messaging → Setup → 2. Connect → AWS → Add key, paste the access key ID and secret, and save.
7. Open Messaging → Setup → Email: provider Amazon SES, your region, the from address (e.g. orders@yourshop.com), save, then Check my email setup. When every line is green, add a template and send a test.

{
  "Version": "2012-10-17",
  "Statement": [
    { "Sid": "Email", "Effect": "Allow", "Action": ["ses:SendEmail", "ses:SendRawEmail", "ses:GetAccount", "ses:GetEmailIdentity"], "Resource": "*" },
    { "Sid": "WhatsApp", "Effect": "Allow", "Action": ["social-messaging:SendWhatsAppMessage", "social-messaging:ListLinkedWhatsAppBusinessAccounts", "social-messaging:GetLinkedWhatsAppBusinessAccount", "social-messaging:ListWhatsAppMessageTemplates", "social-messaging:GetWhatsAppMessageTemplate", "social-messaging:CreateWhatsAppMessageTemplate", "social-messaging:DeleteWhatsAppMessageTemplate"], "Resource": "*" }
  ]
}

What goes where in Claspine

Keep it safe

• The key can send email and read your SES status, nothing else; it cannot read your mail or change your account.
• Keep sending to people who expect your email: SES pauses accounts with many bounces or complaints.

Claspine stores the values encrypted, never shows them again in full, and never sends them to your app or SDK.

If something goes wrong

Check says “SES is in the sandbox”.

Request production access (step 4). Meanwhile SES delivers only to addresses verified under Identities.

Check says the domain is not in SES.

Create the domain identity in the same region you entered in Claspine.

Check says the key was refused.

The key is wrong or disabled, or the user lacks the policy above.

Messages fail with “Email address is not verified”.

You are still in the sandbox, or the from address is not at the verified domain.

Provider documentation

• AWS: verify a domain in SES
• AWS: request production access

← All setup guides