Email server settings

Amazon SES SMTP settings

Q: What are the Amazon SES SMTP settings?

Host email-smtp. .amazonaws.com for your Region, port 587 (or 25, 2587) with STARTTLS or port 465 (or 2465) with TLS, authentication with SES SMTP credentials created for that Region.

Q: What is the Amazon SES SMTP endpoint for us-east-1?

email-smtp.us-east-1.amazonaws.com. AWS lists the endpoints for all Regions, plus FIPS variants, in the SES section of the AWS General Reference.

Q: Can I use my AWS access key as the SES SMTP password?

Not directly. SMTP credentials are created under SMTP settings in the SES console. An SMTP password can be derived from an IAM user’s secret access key with AWS’s script, but not from temporary credentials.

The Amazon SES SMTP settings are a regional endpoint, email-smtp.<region>.amazonaws.com (for example email-smtp.us-east-1.amazonaws.com), on port 587 with STARTTLS or port 465 with TLS. You log in with SES SMTP credentials, which are not your AWS access keys and work only in the Region where you created them.

Last checked October 10, 2026, against AWS’s own documentation.

Amazon SES SMTP endpoint and ports

Server, port and securityServer	Port and security
SMTP · outgoingemail-smtp.<region>.amazonaws.com587, 2587, 25 · STARTTLSReplace `<region>`, e.g. `us-east-1`; all endpoints	587, 2587, 25STARTTLS
SMTP · outgoingemail-smtp.<region>.amazonaws.com465, 2465 · SSL/TLSAWS calls it TLS Wrapper: TLS from the first byte	465, 2465SSL/TLS

Sign-in: SES SMTP credentials

User name: the SMTP user name from the SMTP credentials you create under SMTP settings in the SES console for that Region; the SMTP password comes with it. Your AWS sign-in and access keys don’t work.

Amazon SES SMTP settings explained

One endpoint per Region. AWS lists every SMTP endpoint in Amazon SES endpoints and quotas. Three examples from that table:

email-smtp.us-east-1.amazonaws.com (us-east-1)
email-smtp.eu-west-1.amazonaws.com (eu-west-1)
email-smtp.ap-northeast-1.amazonaws.com (ap-northeast-1)

The table also lists email-smtp.<region>.api.aws host names and, in some US, Canadian and GovCloud Regions, FIPS endpoints (email-smtp-fips.<region>.amazonaws.com). Some Regions, among them Europe (Milan) and Asia Pacific (Jakarta), have no SMTP endpoint; check the table before you pick one. Use the Region where your sending identities are verified and your SMTP credentials were created.

Ports and TLS (AWS). The SES SMTP endpoint requires TLS on every connection:

STARTTLS on 25, 587 or 2587: the client connects, sends EHLO and upgrades the connection with STARTTLS.
TLS Wrapper on 465 or 2465: the server presents its certificate as soon as the client connects, then the SMTP session proceeds normally.
Port 25 from EC2 is throttled by default. Use another port, a VPC endpoint, or ask AWS to remove the email sending limitation.

Firewalls. The endpoint’s IP addresses change frequently, so AWS recommends allowlisting the amazonses.com domain instead of IP addresses (SES SMTP issues).

SES SMTP credentials are separate from your AWS access keys and from your console sign-in, and they are unique to each AWS Region: sending from two Regions needs two sets (AWS).

Open the SES console in the Region you send from and choose SMTP settings.
Choose Create SMTP credentials, keep or change the IAM user name and choose Create user.
Choose Show to see the SMTP password, then copy it or download the .csv file. After you close the dialog you can’t view it again.

Good to know:

SES creates the credentials as an IAM user, so the person creating them needs IAM permissions (iam:CreateUser, iam:CreateAccessKey and others).
To change the password, delete the SMTP user in IAM and create new credentials.
You can derive an SMTP password from an existing IAM user’s secret access key (AWS publishes a script), but not from temporary credentials.
For credentials created before September 6, 2024, keep the AmazonSesSendingAccess policy attached to the SMTP user so its sending isn’t affected.

Before the first email: verified identities and the sandbox

Verify the sender. The From, Source, Sender or Return-Path address or its domain must be a verified identity, and verification is separate for each Region. Publish an SPF record, a DKIM record and a DMARC record for the domain you send from.
Leave the sandbox. Every account starts in the sandbox, per Region: mail goes only to verified addresses and domains or to the SES mailbox simulator, at most 200 messages per 24 hours and 1 message per second (AWS). Request production access in the console (Account dashboard → View Get set up page → Request production access); AWS Support gives a first answer within 24 hours.
Configure the app. In a CMS plugin, a framework or Postfix, enter your Region’s endpoint as host, port 587 with STARTTLS (some apps call it TLS) or 465 with SSL/TLS, turn on authentication, and paste the SMTP user name and password.
Test the connection from the server if nothing goes through. AWS’s command-line test for port 587 (use your Region’s endpoint):
```
openssl s_client -crlf -quiet -starttls smtp \
  -connect email-smtp.us-east-1.amazonaws.com:587
```
A working connection ends with 250 Ok. On Windows, Test-NetConnection -Port 587 -ComputerName <endpoint> checks that the port is reachable.

Common Amazon SES SMTP errors

Error or symptom	Fix
`535` Authentication Credentials Invalid	The app sends wrong credentials, often the AWS access key or console password. Use the SMTP credentials from SMTP settings, created in the same Region as the endpoint.
`530` Authentication required	The app didn’t try to log in. Turn on SMTP authentication.
`554` Message rejected: Email address is not verified. The following identities failed the check in region …	Verify the sender address or domain in that Region. In the sandbox, recipients must be verified too.
`454` Throttling failure: Maximum sending rate exceeded	You send faster than your per-second rate. Retry with growing waits and slow down.
`454` Throttling failure: Daily message quota exceeded	The 24-hour quota is used up. Wait for it to reset or request a higher quota.
`421` Too many concurrent SMTP connections	Too many open connections to the SMTP server. Limit concurrent connections and retry later.
`554` Access denied: User … is not authorized to perform `ses:SendRawEmail` …	The SMTP user’s IAM policy or the identity’s sending authorization policy doesn’t allow `ses:SendRawEmail`. Update the policy.
Timeouts on port 25 from EC2	EC2 restricts port 25 by default. Switch to 587 or 465, or ask AWS to remove the limitation.

Error texts from AWS’s Amazon SES SMTP issues page. AWS advises retrying 4xx responses with progressively longer waits and correcting the request before resending after a 5xx. Bounces from the recipient’s server are explained in the SMTP error codes reference.

Sending quotas and bounce rate

Besides the daily quota and the per-second rate, SES watches your bounce and complaint rates (AWS sending review FAQ):

Metric	AWS recommends	Under review	Sending may be paused
Bounce rate	below 2%	5% or more	10% or more
Complaint rate	below 0.1%	0.1% or more	0.5% or more

The bounce rate counts only hard bounces to domains you haven’t verified, such as “address does not exist”, measured over a representative volume of your sending rather than a fixed time window. Full mailboxes and blocked IP addresses don’t count. Old or imported lists push the rate up fastest: remove dead addresses with a bulk email verifier, or check addresses at sign-up with an email validation API. More ways to keep it low: email bounce rate.

Sources

Checked on October 10, 2026. Server names, ports and sign-in rules come from these official pages:

Other SMTP relay services

Amazon SES SMTP settings: FAQ

What are the Amazon SES SMTP settings?

Host email-smtp.<region>.amazonaws.com for your Region, port 587 (or 25, 2587) with STARTTLS or port 465 (or 2465) with TLS, authentication with SES SMTP credentials created for that Region.

What is the Amazon SES SMTP endpoint for us-east-1?

email-smtp.us-east-1.amazonaws.com. AWS lists the endpoints for all Regions, plus FIPS variants, in the SES section of the AWS General Reference.

Which port should I use for Amazon SES SMTP?

Port 587 with STARTTLS works in most apps; use 465 if the app only offers SSL/TLS. Avoid port 25 on EC2, where it is throttled by default; 2587 and 2465 are further alternatives.

Can I use my AWS access key as the SES SMTP password?

Not directly. SMTP credentials are created under SMTP settings in the SES console. An SMTP password can be derived from an IAM user’s secret access key with AWS’s script, but not from temporary credentials.

Why does SES say “Email address is not verified”?

The sender address or domain isn’t verified in the Region you send from, or, while your account is in the sandbox, the recipient isn’t verified either. Verify the identity in that Region or request production access.

Email validation API

Validate recipients before you send through Amazon SES

emailvalidation.io checks syntax, MX records and the mailbox over SMTP, flags disposable, role and free addresses and returns a quality score, in one request.

/v1/info Email validation API Read the documentation

100 free validations every month. No credit card required.

GET https://api.emailvalidation.io/v1/info?email=support@emailvalidation.io

{
  "email": "support@emailvalidation.io",
  "user": "support",
  "tag": "",
  "domain": "emailvalidation.io",
  "format_valid": true,
  "mx_found": true,
  "smtp_check": true,
  "catch_all": null,
  "role": true,
  "disposable": false,
  "free": false,
  "score": 0.64,
  "state": "deliverable",
  "reason": "valid_mailbox",
  "did_you_mean": ""
}

Free email tools

Is this a real email address? Check whether a mailbox exists, without sending an email. Email spam checker Will your email land in spam? Bulk email validator Which addresses on a list are deliverable? Email header analyzer Trace an email’s route and read its SPF, DKIM and DMARC results. Email extractor Pull every email address out of text or a CSV file. SPF record checker Is the SPF record valid? DMARC record checker Is the domain protected against spoofing? Disposable email checker Is this a throwaway address? Email syntax checker Is the address written correctly? MX record lookup Which servers receive mail for a domain? SPF record generator Build an SPF record and count its DNS lookups. DMARC record generator Create a DMARC record and see where it goes. DKIM record checker Is the DKIM key published? DKIM record generator Create a DKIM key pair and its DNS record. Scam email checker Check a sender for look-alike domains and other scam signals. Email blacklist checker Is your domain or mail server IP on a blacklist?