Railway Post Office clerks sorting letters from bundles into mail sacks inside a mail car

Amazon SES email deliverability consulting: Inbox,not spam.

Amazon SES consulting: SPF, DKIM and DMARC done right, warm IPs, and alarms that catch a bad send before AWS does.

TargetBay on SES

200M+emails a month
99.2%inbox placement, up from 97%
$2,000a month, down from $20,000
3 weeksto move off SendGrid

Amazon SES email deliverability consulting — SPF, DKIM, DMARC, dedicated IPs, sender reputation, suppression-list hygiene, and CloudWatch deliverability dashboards. TargetBay scaled to 200M+ emails per month on SES.

What we switch on in your account

SPF, DKIM and DMARC aligned
2048-bit Easy DKIM, SPF for every sender you use, DMARC moved from p=none to p=reject.
Receipts apart from campaigns
Own configuration set, IP pool and subdomain each, so a newsletter complaint can never hold up a password reset.
New IPs warmed, not burned
200 to 500 sends a day to your most engaged contacts, rising to full volume over about 30 days.
Pause one stream, not the account
The alarm triggers a Lambda that sets SendingEnabled=false on that configuration set. The rest keep sending.
Bot opens out of your reports
Events marked isBotEvent: Likely (since August 7, 2026) are dropped before anyone reads open rate.

A clerk sorting letters into a pigeonhole case labelled with stops on the transcontinental airmail route — Every message into the right slot: the job hasn’t changed, only the speed.

A password reset, start to inbox

First, the app drops the message on a queue and moves on.

ApplicationPassword reset requested for ana@example.com

SQS · transactional-sendMessage queued

Retries and a dead-letter queue sit here, not in your app code.
Consumers are sized to your MaxSendRate.

Then Lambda renders the template and calls the SES API.

Lambda · renderTemplate reset-password, configuration set transactional

SES · SendEmailSigned with DKIM

From mail.yourdomain.com on the transactional IP pool.
Throttling errors back off and retry.

Next, SES reports what happened to the message.

Event destinationDELIVERY, BOUNCE, COMPLAINT, REJECT to SNS or EventBridge

Suppression handlerOn every bounce

Hard bounces go on the account suppression list.
Complaints unsubscribe the address everywhere.

Finally, CloudWatch watches the rates before AWS does.

Reputation.BounceRatetransactional 0.4% · marketing 1.1%

AlarmsWarning at 2% · AWS line at 5%

Two alarm levels per metric, routed to on-call through SNS.
Quota above 80% and queue age alarm too.

Marketing campaigns: Step Functions validates the list, batches sends under your rate limit, tracks progress and streams events through Firehose to S3.
Inbound email: Receipt rules store mail in S3, hand it to Lambda and notify through SNS: support tickets, invoice intake, lead capture.

The full design, with consumer concurrency sized to MaxSendRate and DLQ redrive, is in the SES queued sending pattern.

Check your rates

Reputation check$10.00 a month at a-la-carte

Bounce rate: 2.1% Past our 2% warning line
Complaint rate: 0.06% Past our 0.05% warning line
Gmail spam rate: Normal delivery

SES reviews an account at 5% bounces or 0.1% complaints and may pause at 10% or 0.5%. Gmail does not report spam to SES, so its rate comes from Postmaster Tools.

What Gmail, Yahoo and Microsoft require

Anyone sending about 5,000 emails a day to consumer inboxes. These bars sit with the mailbox providers, apart from your SES account standing.

Requirement	The gap we usually find	What we set up
SPF, DKIM and DMARC, aligned	SPF and DKIM pass on their own but never align with the From domain, or DMARC sits at p=none with no plan.	Alignment on every sending source, DMARC reports read, then quarantine and reject. Enforcement also unlocks BIMI.
One-click unsubscribe (RFC 8058)	Marketing templates carry a footer link but no List-Unsubscribe-Post header. SES does not add it for you.	The header in every bulk template, and an endpoint that honours the POST within two business days.
Gmail spam rate under 0.10%	Nobody watches Postmaster Tools, so Gmail throttles mail while the SES console still looks healthy.	Postmaster Tools connected and alarmed alongside SES complaint metrics, per stream.
Microsoft consumer inboxes	Microsoft has enforced the same bar since May 5, 2025, but setups audited for Google and Yahoo were never checked against Outlook, Hotmail and Live.	The same authentication bar checked for Microsoft, with delivery tracked by mailbox provider.

SES alarm lines

Metric	Our warning	Review	May pause
Bounce rate	2%	5%	10%
Complaint rate	0.05%	0.1%	0.5%

CloudWatch metrics Reputation.BounceRate (hard bounces) and Reputation.ComplaintRate, as ratios: 0.05 is 5%. Source: AWS reputation metrics messages.

Gmail spam rate

Spam rate	What Gmail does
Below 0.08%	Normal delivery
0.08% to 0.10%	Inbox placement degrades
Above 0.10%	Delivery throttled
Above 0.30%	Blocked or rejected

DMARC at enforcement also lets your logo show in Gmail, Yahoo and Apple Mail. See the BIMI on SES guide.

30 daysto warm a new dedicated IP

A cold IP has no history, so Gmail and Microsoft throttle it. We raise volume in steps and adjust each one to bounces, complaints and seed tests. Day by day, including SES managed warm-up, in the warm-up guide.

200–500Days 1–3Most engaged contacts only
500–1,000Days 4–7Broader audience
1,000–5,000Days 8–14Watch bounces closely
5,000–25,000Days 15–21Seed tests at major providers
25,000–100,000Days 22–30Approach target volume

Daily emails per stage, heights on a log scale. After day 30: full volume, monitored.

What SES costs since July 21, 2026

$0.10

per 1,000 emails

No monthly fee. Dedicated IPs about $24.95 each a month; VDM billed per message. Right when you only need outbound send.

$0.16

per 1,000, first 10M

Send plus Virtual Deliverability Manager. No fixed fee. New accounts start here since July 21, 2026. Bare send costs more than a-la-carte.

$105

a month, per region

Plus $0.22 per 1,000. Adds a managed dedicated IP, email validation and global VDM. Often cheaper once you would buy those anyway.

$500

a month, per region

Plus $0.23 per 1,000. Adds Global Endpoints, 1,000 tenants and Mail Manager open ingress. For multi-region and multi-tenant senders.

Send-only cost against typical ESP tiers

Emails a month	SES a-la-carte	SendGrid Pro	Mailgun Scale
100,000	$10	$19.95	$35
500,000	$50	$99.95	$90
1,000,000	$100	$249+	$250+
10,000,000	$1,000	about $2,000+	about $1,500+

Before attachments, dedicated IPs and plan fees. Break-even maths at your volume is in the SES pricing plans guide.

Eighteen checks we run first

Authentication

SPF record passingevery sender
DKIM keys2048-bit
DMARC policyquarantine or reject
DMARC reports readweekly
One-click unsubscribeRFC 8058

Reputation

Bounce ratebelow 2%
Complaint ratebelow 0.05%
Gmail spam ratebelow 0.08%
Dedicated IPs warmed30 days
Transactional and marketing splitIPs and subdomains

Operations

Hard bounces suppressedautomatic
Complaints unsubscribedautomatic
Inactive subscribers removedon a schedule
Content tested before sendingevery campaign
CloudWatch alarmstwo levels
Gmail Postmaster Toolsconnected
VDM and inbox placement testsenabled
Tenant suppression scopeper tenant

Have us run them on your account

Compliance, built into the sending

Postal clerks lowering mail sacks down a chute from a loading platform

CAN-SPAM: A physical address, a working unsubscribe and honest subject lines, enforced in the templates and the sending code.
GDPR: Consent from your platform through Lambda and DynamoDB, retention rules, per-request tracking overrides and erase-on-request.
HIPAA: SES is HIPAA-eligible inside a BAA-covered account. We enforce TLS, audit logging and access controls.

Related SES work

The full guide to SES deliverability

What is AWS SES?

AWS Simple Email Service (SES) is a cloud-based email platform that enables businesses to send and receive emails at scale with industry-leading deliverability, security, and cost efficiency. Whether you need to send transactional emails (order confirmations, password resets, shipping notifications), marketing campaigns, or automated notifications, SES provides the infrastructure to handle millions of emails per day at a fraction of the cost of traditional email service providers.

SES is not just an SMTP relay. It is a full email platform with domain authentication, deliverability tools, sending analytics, content filtering, and email receiving capabilities — all integrated into the broader AWS ecosystem. At FactualMinds, we help organizations design, deploy, and optimize SES implementations that deliver consistently to the inbox. We have helped clients scale from thousands to over 200 million emails per month while maintaining strong sender reputation and deliverability.

Looking to migrate from SendGrid, Mailgun, or SparkPost to SES? See our dedicated SES Migration & Email Delivery Services for migration-specific planning, IP warming, and cutover strategies.

Why Organizations Choose AWS SES

Unmatched Cost Efficiency

As of July 21, 2026, SES offers a-la-carte outbound at $0.10 per 1,000 emails and hierarchical Essentials / Pro / Enterprise pricing plans (higher unit rates; Pro adds $105/account/region/month, Enterprise $500). Plans bundle deliverability capabilities; they do not make dedicated IPs free on Essentials/a-la-carte. Standard dedicated IPs remain about $24.95/month each a-la-carte; managed DIPs and Global VDM are included on Pro/Enterprise (see the SES pricing plans guide).

Illustrative a-la-carte send-only vs typical ESP tiers (before attachments, DIPs, or plan fixed fees):

Monthly Volume	SES a-la-carte send	SendGrid Pro	Mailgun Scale
100,000 emails	$10	$19.95	$35
500,000 emails	$50	$99.95	$90
1,000,000 emails	$100	$249+	$250+
10,000,000 emails	$1,000	Custom (typically $2,000+)	Custom (typically $1,500+)

When you need managed dedicated IPs + Global VDM, model Pro against a-la-carte add-ons — Pro often wins at mid volume.

AWS Ecosystem Integration

SES integrates natively with other AWS services, enabling powerful email workflows:

Lambda — Trigger functions on email events (bounce, complaint, delivery) for real-time processing
SNS — Publish email events to topics for fan-out to multiple subscribers
SQS — Queue email events for reliable, ordered processing
S3 — Store received emails and email templates
CloudWatch — Monitor sending metrics, set alarms on bounce/complaint rates
Kinesis Data Firehose — Stream email events to data lakes for analytics

Proven Scale

SES handles a significant portion of Amazon’s own email — order confirmations, shipping notifications, and marketing communications for hundreds of millions of customers. This battle-tested infrastructure means SES can scale to handle virtually any volume without you managing a single mail server.

Email Authentication: The Foundation of Deliverability

Email authentication is the single most important factor in inbox placement. Without proper authentication, your emails are far more likely to be flagged as spam, regardless of content quality. We configure all three authentication protocols as part of every SES implementation.

SPF (Sender Policy Framework)

SPF tells receiving mail servers which IP addresses are authorized to send email on behalf of your domain. We configure SPF records to include SES sending IPs and any other authorized sources (Google Workspace, Microsoft 365, marketing platforms).

DKIM (DomainKeys Identified Mail)

DKIM adds a cryptographic signature to every email, allowing receivers to verify the email was not tampered with in transit and was genuinely sent from your domain. SES supports Easy DKIM with 2048-bit keys and automatic key rotation.

DMARC (Domain-based Message Authentication, Reporting, and Conformance)

DMARC ties SPF and DKIM together and tells receiving servers what to do with emails that fail authentication — monitor, quarantine, or reject. We implement DMARC with a phased approach:

Monitor mode (p=none) — Collect reports without affecting delivery
Quarantine mode (p=quarantine) — Send failing emails to spam
Reject mode (p=reject) — Block unauthenticated emails entirely

We analyze DMARC reports to identify unauthorized senders using your domain (spoofing) and ensure all legitimate sources pass authentication before moving to enforcement.

Reaching DMARC enforcement (p=quarantine or p=reject) also unlocks BIMI (Brand Indicators for Message Identification) — a standard that displays your brand logo next to your sender name in Gmail, Yahoo Mail, and Apple Mail. BIMI requires a DMARC policy at enforcement level as a prerequisite, plus a Verified Mark Certificate (VMC) from an approved authority (Entrust or DigiCert, approximately $1,000–$1,500/year). For brands where inbox recognition and trust signals matter, BIMI is a compelling reason to accelerate DMARC enforcement. Setup steps are in our BIMI on Amazon SES implementation guide.

2024–2026 Bulk Sender Requirements (Google, Yahoo, Microsoft)

In February 2024, Google and Yahoo enforced requirements for anyone sending roughly 5,000 or more emails per day to their consumer addresses. Microsoft followed with enforcement for high-volume senders to Outlook.com / Hotmail / Live consumer mailboxes beginning May 5, 2025. These are delivery requirements at the mailbox-provider layer, independent of your SES account standing.

What Is Required

1. Email Authentication (SPF + DKIM + DMARC)

Bulk senders must have all three authentication records configured and passing with alignment. DMARC is now mandatory at minimum p=none — a missing DMARC record will cause Gmail to apply additional filtering to your messages.

2. One-Click Unsubscribe (RFC 8058)

All marketing and bulk email must include a List-Unsubscribe-Post header (RFC 8058). When a Gmail user clicks “Unsubscribe” in the Gmail UI, Gmail sends a machine-processable POST request to this header URL, and the sender must honor it within two business days. A standard unsubscribe link in the email body is not sufficient.

SES does not add this header automatically — it must be included in your email templates or sending code. We implement RFC 8058-compliant unsubscribe handling as part of every campaign architecture.

3. Gmail Spam Rate Threshold

Gmail Postmaster Tools now enforces spam rate limits at the inbox provider level:

Spam Rate	Gmail Response
Below 0.08%	Normal delivery
0.08% – 0.10%	Warning threshold — inbox placement degrades
Above 0.10%	Delivery throttling begins
Above 0.30%	Messages blocked or rejected

This is separate from the SES account review threshold (0.1% complaint rate via SES feedback loops). Your SES account can be in good standing while Gmail is actively downgrading your inbox placement. We monitor both.

Why This Matters for Your SES Setup

These requirements affect all bulk senders — not just new ones. If you set up SES before 2024–2025 and have not audited for Microsoft’s bar, you may still fail Outlook consumer delivery. Common gaps we find:

DMARC policy exists but is at p=none without a plan to reach enforcement
Email templates lack List-Unsubscribe-Post headers on marketing streams
Spam rate not monitored in Gmail Postmaster Tools (separate from SES complaint metrics)
SPF and DKIM passing individually but not achieving DMARC alignment
Microsoft consumer domains never included in authentication / Postmaster-style monitoring

SES Architecture Best Practices

Separate Transactional and Marketing Email

Transactional emails (password resets, order confirmations, receipts) have fundamentally different deliverability requirements than marketing emails (newsletters, promotions, re-engagement campaigns). A spam complaint on a marketing campaign should never impact your transactional email delivery.

We implement separation at multiple levels:

Separate configuration sets — Different sending configurations, event destinations, and suppression lists
Separate dedicated IPs — Transactional emails on their own IP pool isolated from marketing reputation
Separate subdomains — mail.yourdomain.com for transactional, marketing.yourdomain.com for campaigns
Separate monitoring — Independent bounce/complaint dashboards and alert thresholds

Dedicated IP Management and Warming

When you add a new dedicated IP to SES, it has no sending history — mailbox providers like Gmail and Microsoft do not trust it yet. Sending high volumes immediately from a cold IP will result in throttling or blocking.

We implement a structured warm-up plan:

Day	Daily Volume	Notes
1-3	200-500	Send only to your most engaged contacts
4-7	500-1,000	Gradually include broader audience
8-14	1,000-5,000	Monitor bounce rates closely
15-21	5,000-25,000	Check inbox placement at major providers
22-30	25,000-100,000	Approach target volume
30+	Target volume	Full sending with ongoing monitoring

We adjust this schedule based on bounce rates, complaint rates, and inbox placement testing at each stage. The day-by-day method, including SES managed warm-up, is in our SES dedicated IP warm-up guide.

Bounce and Complaint Management

SES places an account under review at a 5% bounce rate or a 0.1% complaint rate (AWS reputation metrics messages); the pause levels are in the alarm thresholds table below. Proactive management is essential:

Hard bounce suppression — Automatically add hard-bounced addresses to the SES account-level suppression list
Complaint processing — Process feedback loop (FBL) complaints via SNS and automatically unsubscribe complainants
Soft bounce retry logic — Implement exponential backoff for temporary failures without over-retrying
List hygiene — Verify email addresses before sending using validation services; remove inactive subscribers after defined periods
Tenant-level suppression (June 1, 2026) — For SaaS, agencies, and multi-brand senders, configure suppression scope per tenant so one tenant’s bounce/complaint events do not suppress delivery for the rest. Uses the same PutSuppressedDestination / GetSuppressedDestination / DeleteSuppressedDestination / ListSuppressedDestinations operations with a TenantName parameter

Building Email Workflows with SES

Transactional Email Pipeline

For applications that need reliable transactional email delivery:

Application → SQS Queue → Lambda (template rendering) → SES API → SNS (events) → CloudWatch (monitoring)

This architecture decouples email sending from your application logic, handles retries gracefully, and provides complete visibility into delivery status. For burst traffic and multi-tenant senders, the full design (consumer concurrency sized to MaxSendRate, throttling retries, DLQ redrive, per-tenant configuration sets) is in our SES queued sending pattern, and our SES queued sending service builds it for you.

Marketing Campaign Architecture

For bulk marketing campaigns:

Campaign Manager → S3 (recipient lists) → Step Functions (orchestration) → Lambda (batching + throttling) → SES API → Kinesis Firehose → S3 (event archive)

Step Functions orchestrate the campaign lifecycle: validate the recipient list, batch sends to respect SES rate limits, track progress, and generate post-campaign analytics.

Inbound Email Processing

SES can receive emails and trigger automated workflows:

Incoming Email → SES Receipt Rules → S3 (store) + Lambda (process) + SNS (notify)

Use cases include automated support ticket creation, document intake (invoices, contracts), lead capture from email inquiries, and automated forwarding with transformation.

Email Deliverability Checklist

Use this checklist to evaluate your current email infrastructure health:

If any items are unchecked, your deliverability is at risk. Contact us for a free deliverability assessment →

SES Monitoring and Analytics

We implement comprehensive monitoring so you always know the health of your email infrastructure:

Real-Time Dashboards

CloudWatch dashboards showing:

Sends, deliveries, bounces, complaints, and rejections per hour/day
Bounce rate and complaint rate trends with threshold indicators
Delivery rate by mailbox provider (Gmail, Microsoft, Yahoo)
Dedicated IP reputation scores

AWS Virtual Deliverability Manager (VDM)

Amazon SES includes Virtual Deliverability Manager — a native deliverability intelligence tool that provides inbox placement testing, engagement analytics, and automated recommendations without requiring third-party tools.

What VDM provides:

Inbox placement testing — Send to a seed list across 35+ mailbox providers (Gmail, Microsoft, Yahoo, Apple Mail, and more) to see where your emails land before sending to your real list
Inbox placement rates (May 29, 2026) — Per-domain and per-campaign placement estimates calculated from representative industry data, available in every commercial AWS region where SES is offered. Pro-actively test candidate email content to estimate inbox placement at top mailbox providers before you press send
Blocklist monitoring (May 29, 2026) — Passive, peripheral awareness of industry blocklist activity surfaced alongside the rest of the deliverability dashboard so reputation slips are caught before they escalate
VDM Advisor — Automated recommendations surfacing authentication issues, poor IP reputation, high bounce rates, and problematic sending patterns
Engagement analytics — Open and click tracking at the configuration set level, segmented by mailbox provider. As of August 7, 2026, Open and Click event payloads include isBotEvent (Likely or Unlikely) automatically when you already publish those events — filter bots before you treat open rate as human engagement (What’s New).
Send-time tracking overrides (August 21, 2026) — ConfigurationOverrides on SendEmail / SendBulkEmail enable or disable open and click tracking per request, taking precedence over the configuration set. Use this for GDPR/CNIL per-recipient consent instead of maintaining a configuration set per tracking combo (What’s New).
Deliverability dashboard — Centralized view of sending reputation, inbox placement rates, and complaint trends over time

How the VDM advisor works. The advisor lists open recommendations by impact and sending identity: missing or malformed SPF, DKIM, DMARC, or BIMI records, and keys that are too short. Each recommendation links to the fix in the SES Developer Guide, and resolved items stay visible for 30 days. With global deliverability enabled, the advisor also raises a recommendation when a monitored domain or IP lands on a blocklist, with the listing reason and delisting guidance. Advisor events can be routed to Amazon EventBridge, so a new high-impact recommendation can open a ticket instead of waiting for someone to check the console.

VDM is billed per message on top of standard SES sending, and it is bundled differently across the Essentials, Pro, and Enterprise plans. Check current rates in the SES pricing plans guide before you turn it on.

We enable and configure VDM as part of all new SES implementations and retrofits.

Bounce and Complaint Rate Alarms

SES publishes your account’s reputation to CloudWatch as Reputation.BounceRate and Reputation.ComplaintRate, and per configuration set when reputation metrics are enabled on it. Values are ratios: 0.05 means 5%.

Metric	AWS-recommended alarm	Account under review	Sending may pause
`Reputation.BounceRate` (hard bounces)	≥ 0.05 (5%)	5% or more	10% or more
`Reputation.ComplaintRate`	≥ 0.001 (0.1%)	0.1% or more	0.5% or more

Source: Creating reputation monitoring alarms using CloudWatch. AWS’s recommended alarm sits at the review line, so we add an earlier warning alarm (typically 2% bounces and 0.05% complaints, matching the checklist above) to get time to act before review starts.

What we wire for every SES account:

Two alarm levels per metric (warning and AWS-recommended), routed through SNS to the on-call channel, with missing data treated as “ignore” so quiet periods do not flap
Per-configuration-set alarms for transactional, marketing, and each tenant, so a spike points at one stream instead of the whole account
Automatic pause of the offending stream: the alarm publishes to SNS, and a Lambda function calls PutConfigurationSetSendingOptions (SESv2) with SendingEnabled=false for that configuration set while the rest keep sending
Configuration-set event destinations to EventBridge or SNS for BOUNCE, COMPLAINT, DELIVERY, and REJECT, feeding the suppression handler and per-tenant reporting
Quota and backlog alarms: sending quota utilization above 80%, and queue age when sends run through a queued sending pipeline

Long-Term Analytics

Using Kinesis Data Firehose to stream SES events to S3, we enable long-term analytics:

Campaign performance trends over time
Engagement segmentation (opens, clicks by audience — subtract isBotEvent: Likely before you report human open rate)
Optimal send time analysis
Revenue attribution for transactional emails

SES and Compliance

CAN-SPAM Act

All commercial emails must include a physical mailing address, a clear unsubscribe mechanism, and honest subject lines. We configure SES templates and sending logic to enforce compliance automatically.

For organizations sending to EU recipients, we implement consent management, data retention policies, and the ability to purge all email data for a specific individual on request. SES integrates with your consent management platform through Lambda and DynamoDB.

HIPAA

SES is HIPAA-eligible when used within a BAA-covered AWS account. We configure SES for healthcare organizations with encryption in transit (TLS enforcement), audit logging, and access controls that meet HIPAA requirements. We also ensure broader AWS security compliance for healthcare environments.

Getting Started

Whether you are implementing SES for the first time, optimizing an existing setup, or migrating from another email provider, our team brings deep email infrastructure expertise and hands-on SES experience at scale.

Questions teams ask

How much does AWS SES cost compared to SendGrid or Mailgun?

A-la-carte SES outbound is still $0.10 per 1,000 emails with no monthly minimum. As of July 21, 2026, AWS also offers Essentials, Pro ($105/account/region/month), and Enterprise ($500/account/region/month) pricing plans that bundle deliverability features (VDM, managed dedicated IPs, validation, and more) at higher per-1k rates. Dedicated IPs remain billable a-la-carte (~$24.95/IP or managed DIP fees) unless included in Pro/Enterprise. At 1M emails/month on a-la-carte send-only, SES is still roughly $100 versus $250–$400+ on many ESP tiers — but compare plan totals when you need managed DIPs and Global VDM. See our SES pricing plans guide for break-even math.

What is the difference between your SES Solutions and SES Migration services?

Our SES Solutions service covers new SES implementations, ongoing optimization, deliverability management, and application integration for organizations already on SES or building new email capabilities from scratch. Our SES Migration service is specifically for organizations moving from another email provider (SendGrid, Mailgun, SparkPost) to SES — it includes DNS cutover planning, IP warming, API endpoint migration, and reputation transfer strategies.

How do you improve email deliverability on SES?

We take a multi-layered approach: proper authentication setup (SPF, DKIM, DMARC), dedicated IP warming over 2-4 weeks with gradually increasing volumes, bounce and complaint rate monitoring with automated suppression lists, feedback loop integration, content optimization to avoid spam triggers, and ongoing sender reputation management. We measure the result with VDM inbox placement data rather than promising a fixed percentage.

Can SES handle both transactional and marketing emails?

Yes, and we recommend separating them using dedicated configuration sets with different dedicated IPs. Transactional emails (order confirmations, password resets, receipts) require high reliability and should not be affected by marketing email reputation. We set up separate sending identities, IPs, and monitoring for each email type.

What happens if our SES account gets suspended?

SES places an account under review at a 5% bounce rate or 0.1% complaint rate, and can pause sending at higher rates (see the alarm thresholds table on this page). We prevent this by implementing real-time bounce and complaint monitoring, automatic suppression list management, list hygiene verification before campaigns, and gradual warm-up strategies. If suspension occurs, we handle the remediation process with AWS support to restore sending capabilities.

Does SES support email receiving as well as sending?

Yes. SES can receive emails and trigger automated workflows — route emails to S3 for archival, invoke Lambda functions for processing, publish to SNS topics for notifications, or forward to other email addresses. We build email processing pipelines for use cases like support ticket creation, document intake, and automated reply systems.

Do we need to meet 2024–2026 bulk sender requirements (Google, Yahoo, Microsoft)?

If you send roughly 5,000 or more emails per day to consumer mailboxes, yes. Google and Yahoo enforce SPF + DKIM + DMARC (alignment), one-click unsubscribe (RFC 8058) on marketing mail, and spam/complaint ceilings (Gmail Postmaster spam rate under 0.10%; published bulk-sender guidance also cites staying under 0.3% spam complaints). Microsoft began enforcing SPF + DKIM + DMARC for high-volume senders to Outlook consumer mailboxes on May 5, 2025. These are separate from SES account review thresholds (bounce ~5%, complaint ~0.1% via SES feedback). We audit and remediate all three provider bars as part of deliverability work.

What happens if our SES account gets suspended and Gmail is throttling delivery?

SES reviews your account on its own bounce and complaint rates (see the alarm thresholds table on this page). Additionally, Gmail enforces its own spam rate thresholds via Gmail Postmaster Tools — these operate independently of your SES account status. Gmail begins degrading inbox placement at a 0.08% spam rate and throttles delivery above 0.10%. You could have a healthy SES account while Gmail is actively blocking your mail. We prevent this by implementing real-time bounce and complaint monitoring, automatic suppression list management, list hygiene verification before campaigns, gradual warm-up strategies, and Gmail Postmaster Tools integration for cross-visibility. If suspension occurs, we handle the remediation process with AWS support to restore sending capabilities.

How do I set up an Amazon SES bounce rate alert?

Open Reputation metrics in the SES console, choose View in CloudWatch on the bounce rate pane, and create an alarm on Reputation.BounceRate with a static threshold of Greater/Equal 0.05 (the metric is a ratio, so 0.05 is 5%). Send it to an SNS topic your on-call team watches and treat missing data as ignore. Add an earlier warning alarm (for example 0.02) so you can act before AWS places the account under review at 5%.

Source: Creating reputation monitoring alarms using CloudWatch

What bounce and complaint rates get an Amazon SES account paused?

AWS places the account under review at a bounce rate of 5% or more and may pause sending at 10% or more. For complaints, review starts at 0.1% and sending may pause at 0.5%. Rates are calculated over a representative volume of your recent sending, and only hard bounces count toward the bounce rate.

Source: Amazon SES reputation metrics messages

How do I monitor Amazon SES bounce rate per customer or per mail stream?

Send each stream (transactional, marketing, each tenant) through its own configuration set, enable reputation metrics on each one, and publish BOUNCE and COMPLAINT events to an EventBridge or SNS event destination. CloudWatch then has per-configuration-set reputation metrics you can alarm on, and an alarm action can pause just that configuration set instead of the whole account.

Source: Monitoring your Amazon SES sender reputation

What does the Virtual Deliverability Manager advisor check?

The VDM advisor flags infrastructure problems by sending identity and impact: missing or malformed SPF, DKIM, DMARC, and BIMI records and DKIM keys that are too short, with a link to the fix for each. With global deliverability enabled it also reports when a monitored domain or IP is on a blocklist, including delisting guidance. Advisor events can be sent to EventBridge for automated ticketing.

Source: Virtual Deliverability Manager advisor

Find out why your email is landing in spam

Send us your sending domains and current bounce and complaint rates. We review authentication, reputation, IP setup and suppression handling, then tell you what to fix first.

Book a deliverability assessment

Photographs: “Railway Post Office Clerks at Work”, “Sorting airmail” and “Clerks Transferring Mail Sacks”, Smithsonian Institution, no known copyright restrictions, via Wikimedia Commons; hero cropped and darkened. Sorting machine clip by Legoktm, CC BY-SA 4.0, via Wikimedia Commons.