Connecting Amazon SES to AcelleMail

AcelleMail is a growing self-hosted email marketing platform. It manages contacts, campaigns, automation, sending queues, and reporting, while the actual email delivery is handled by a separate sending service.

Amazon SES is one of the services that can be used for email delivery. AcelleMail supports both the Amazon SES API and SMTP. This guide focuses on the SES API because it also allows AcelleMail to manage sending identities and configure bounce and complaint notifications.

The setup has three main parts:

1. Create an AWS IAM user and access key.
2. Add Amazon SES as a sending server in AcelleMail.
3. Configure the sending domains and SES settings.

Once the sending server is connected, AcelleMail can also configure the SES resources it needs for bounce and complaint handling.

1. Create an AWS IAM user

AcelleMail needs AWS credentials to connect to Amazon SES.

It is better to create a dedicated IAM user for AcelleMail instead of using the AWS root account credentials. A dedicated user can be disabled or have its access keys rotated without affecting other AWS services.

In the AWS console, open IAM.

Go to IAM → Users and click Create user.

You can use a name such as:

acellemail-ses

The user does not need console access because AcelleMail will use its access key to access AWS.

Attach the required permissions

On the permissions step, choose Attach policies directly.

Attach these three AWS managed policies:

These policies provide broader permissions than a custom least-privilege policy. If the AWS account is dedicated to AcelleMail, this can be a practical setup. If the account also contains other production resources, consider creating a more restricted IAM policy instead.

Create an access key

Open the IAM user's Access keys section and click Create access key.

When AWS asks what the key will be used for, choose Third-party service.

AWS will then show the Access key and Secret access key.

Save both values. AWS only shows the secret access key when it is created. If you lose it later, create a new key and deactivate the old one.

AcelleMail stores the AWS credentials in its database because it needs to access SES without user interaction. The AWS secret access key is encrypted at rest.

You should still use a dedicated IAM user, limit its permissions where practical, and rotate its access keys periodically.

2. Add Amazon SES to AcelleMail

Once you have the AWS access key, add it to AcelleMail.

Log in to AcelleMail as an administrator and open:

Sending → Sending Servers

Click Add Server and select:

Amazon Web Service API

AcelleMail also supports Amazon Web Service SMTP. The SMTP option requires SES SMTP credentials, while the API driver uses the AWS access key directly.

For this setup, we recommend the Amazon Web Service API driver.

Under Connection details, enter:

• AWS Access Key ID
• AWS Secret Key
• AWS Region

The region is important because Amazon SES identities and quotas are regional.

Click Save Changes.

Test the connection

After saving the server, AcelleMail provides two useful tests.

Test Connection checks the AWS credentials and the permissions required by AcelleMail.

Send Test Email sends an actual email through Amazon SES.

Use Test Connection first. If it reports a permission problem, fix the IAM permissions before testing email delivery.

If the SES account is still in the sandbox, the test recipient must be a verified email address.

If you are running AcelleMail with multiple users or plans, also make sure the sending server is assigned to the appropriate plan. A correctly configured sending server will not send anything if no plan or user is allowed to use it.

3. Bounce and complaint notifications

AcelleMail uses Amazon SNS to receive bounce and complaint notifications from SES.

When the SES sending server is connected, AcelleMail creates the required SNS topic and subscription automatically.

This allows AcelleMail to receive notifications from SES and associate them with the corresponding contacts. Contacts affected by hard bounces or complaints can then be excluded from later campaigns.

There is one important requirement: your AcelleMail installation must be publicly accessible.

SNS needs to send notifications to an endpoint on your AcelleMail installation. A localhost address, private IP address, or VPN-only hostname cannot receive these notifications from AWS.

Make sure APP_URL points to the public URL of your AcelleMail installation before enabling the SES server.

If this is not configured correctly, email sending may still work, but bounce and complaint notifications will not be processed.

4. Share verified sender identities

Every email sent through SES must use a verified sender identity.

If you have already verified domains in Amazon SES, you can manage them from the AcelleMail sending server:

Advanced → Sender Identity

The list shows the SES identities available in the selected region.

You can make a verified domain available in two ways.

Available for all

Enable Available for all if all users on the AcelleMail installation should be able to send from that domain.

Assign to a user

Alternatively, set an Owner for the identity. The selected customer will then be able to use that domain.

Only identities with an Active status can be used for sending.

If an identity is marked Failed, the problem needs to be fixed in Amazon SES or DNS before it can be used.

Once a domain is available to a user, it appears in the campaign's From email field under Verified senders.

5. Add customer sending domains

In a multi-user AcelleMail installation, customers will usually want to send from their own domains.

A customer can add a domain from:

Sending domains → Add domain

When the customer's account uses the Amazon SES sending server, AcelleMail registers the domain with SES and displays the DNS records that need to be added.

The domain page shows a Synced · Amazon SES status and the required records.

The records normally include:

• Domain identity — a TXT record at _amazonses.theirdomain.com
• DKIM — three CNAME records ending in .dkim.amazonses.com
• SPF — a TXT record containing v=spf1 include:amazonses.com ~all

After publishing the records, click Verify DNS records in AcelleMail.

DNS changes can take some time to propagate, so the verification can be run again later.

Two common DNS problems

Do not create multiple SPF records

A domain should have one SPF record.

If the domain already has an SPF record for Google Workspace or another email service, add the Amazon SES include to the existing record instead of creating a second SPF record.

For example:

v=spf1 include:google.com include:amazonses.com ~all

Multiple SPF records can result in a permerror and cause SPF validation to fail.

Check how your DNS provider handles record names

Some DNS providers automatically append the domain name to the host field.

For example, entering:

_amazonses.theirdomain.com

may result in:

_amazonses.theirdomain.com.theirdomain.com

If the SES identity remains in Pending, check the actual DNS record rather than relying only on what is shown in the DNS control panel.

You can check the TXT record with:

dig +short TXT _amazonses.theirdomain.com

And a DKIM record with:

dig +short CNAME <selector>._domainkey.theirdomain.com

6. SES sandbox, quotas and regions

There are three Amazon SES settings you should check before sending a real campaign.

SES sandbox

New SES accounts start in the sandbox, and the restriction applies per region.

In the sandbox:

• recipients generally need to be verified
• the sending limit is 200 messages per 24 hours
• the sending rate is 1 message per second

To request production access, open the SES Account dashboard and choose Request production access.

The review is asynchronous, so it is worth requesting production access while you are configuring your domains and AcelleMail.

Sending quotas

Production access does not mean that every AWS account has the same sending quota.

SES sets sending quotas per account and region. Check the current quota in the AWS Account dashboard and use that value when configuring sending limits in AcelleMail.

Do not assume that a commonly quoted quota such as 50,000 emails per day applies to your account.

AWS regions

SES identities and sending quotas are regional.

For example, if you verified a domain in:

us-east-1

but configured AcelleMail to use:

eu-west-1

the verified identity will not appear in the AcelleMail server's Sender Identity list.

Make sure the region used by AcelleMail is the same region where your SES identities are configured.

7. Common problems

Summary

To connect AcelleMail to Amazon SES:

1. Create a dedicated AWS IAM user.
2. Give it the permissions required by AcelleMail.
3. Create an AWS access key.
4. Add the credentials to an Amazon Web Service API sending server in AcelleMail.
5. Use Test Connection before sending a campaign.
6. Make sure APP_URL is publicly accessible so SNS can deliver bounce and complaint notifications.
7. Verify your sending domains and publish the required DNS records.
8. Keep the SES region consistent between AWS and AcelleMail.
9. Check your actual SES sending quota before configuring sending limits.

The same setup is also available as a step-by-step guide with screenshots on the AcelleMail website:

How to Set Up Amazon SES in AcelleMail, Step by Step