How to Configure Amazon SES

Amazon SES is listed under Recommended in SMTPPai because it is a strong fit for WordPress transactional mail at scale. This guide walks through every field — including where to click in AWS and what to paste into SMTPPai.

When to choose Amazon SES

• You want API sending (not classic SMTP passwords).
• You can verify a domain (or email identity) in AWS.
• You are comfortable creating an IAM access key with send permission.

Prerequisites in AWS

1. An AWS account.
2. Open the Amazon SES console and pick the region you will send from (top-right region switcher).
3. Verify a domain or email identity in SES for that region (SES → Verified identities). Production sending usually needs you out of the SES sandbox.
4. Create an IAM user that can call SES send APIs. Create an access key under that user (IAM → Users → Security credentials → Create access key). AWS shows the secret access key only once — copy it immediately.

AWS overview: Amazon SES getting started.

Open SMTPPai

1. Go to SMTPPai → Dashboard → Add connection.
2. Under Recommended, click Amazon SES.

Fill the form field by field

Connection name

Example: “Amazon SES — WordPress”. Recipients never see this.

From name / From email

Use an address on your SES-verified identity. If SES only verified example.com, From must be something like noreply@example.com.

Force From Name / Force From Email

Optional. Enable if other plugins change From headers and SES rejects them.

Access key ID

1. Open AWS IAM → Users.
2. Select your SES-capable user → Security credentials → Create access key (or copy an existing Access key ID).
3. Paste the Access key ID into SMTPPai’s Access key ID field.

Secret access key

Paste the secret shown at key creation into Secret access key. If you lost an old secret, create a new access key — AWS will not show the old secret again.

Region

Select the same AWS region where your SES identity is verified. Sending with keys from a different region (or a verified identity only in another region) fails until that identity exists there too.

Credential storage

• Store keys in database — paste keys into the form (encrypted when possible).
• Keep in wp-config.php — define:

  define( 'MAILPAI_SMTP_SES_ACCESS_KEY', 'YOUR_KEY_ID' );
  define( 'MAILPAI_SMTP_SES_SECRET_KEY', 'YOUR_SECRET' );
  define( 'MAILPAI_SMTP_SES_REGION', 'us-east-1' );

  Use your real region code instead of us-east-1 if needed.

DNS (Amazon SES) panel

After the connection is saved, SMTPPai can show SES DNS helpers on the connection:

• Load records from SES — pulls DNS-related records for verification/authentication from SES.
• Check DNS — helps you confirm records are visible.
• Use the link to SES verified identities to finish domain authentication in AWS.

Complete SPF/DKIM (and DMARC as your policy requires) at your DNS host so inbox providers trust your domain.

Save and test

1. Save the connection.
2. On the Dashboard card, click Test, enter your inbox, and send.
3. Confirm success under Email Log.

Common failures

• Message rejected / not verified — From email not verified in that SES region, or account still in sandbox.
• Auth / signature errors — wrong Access key ID or Secret, or keys for a different IAM user.
• Wrong region — identity verified in eu-west-1 but SMTPPai set to us-east-1.

Note on bounces: Tracking bounces in AWS (SNS event destinations) is configured in Amazon, not as a built-in SMTPPai webhook unless you also run MailPai’s bounce handler. Sending works without bounce webhooks.

Related: How connections work · Send a test email · Backup Connection