Amazon Simple Email Service (AWS SES) is a cloud-based email infrastructure service that handles outbound email delivery at massive scale — starting at just on the pay-as-you-go plan. It manages the technical complexity of email delivery: IP reputation, feedback loops, bounce handling, and compliance with ISP policies.
Frequently Asked Questions (FAQs)
QWhat is Amazon SES and why use it with Plunk?
Amazon Simple Email Service (SES) is AWS's managed email sending infrastructure. It handles IP reputation, delivery retry logic, bounce and complaint tracking, and compliance with ISP feedback loops. Plunk is a self-hosted email marketing platform that provides the campaign management UI, subscriber database, and sending queue — but it needs a delivery provider to actually send emails. SES is the recommended provider for Plunk because it is cost-effective ($0.10/1,000 emails on pay-as-you-go), reliable, and natively supported by Plunk's environment variable configuration.
QDo I need to request production access in SES before I can send campaigns?
Yes. New AWS SES accounts are placed in Sandbox mode by default, which restricts sending to only pre-verified email addresses. To send campaigns to real unverified subscribers, you must request production access through the SES console. Submit a request describing your use case, expected email volume, and how you handle bounces and complaints. AWS typically responds within 1–3 business days.
Exclusive Discount Offer
Inquire for Course Fee & Discounts
Get full program details, syllabus breakdown, and claim your exclusive course fee discount for the Best Digital Marketing Course in Guwahati.
Amazon AWS SES Mail Setup with Plunk — Self-Hosted Email Marketing
$0.10 per 1,000 emails
Plunk (github.com/useplunk/plunk) is a free, open-source, self-hosted email marketing platform. It gives you subscriber management, visual email campaign editing, contact import/export, and delivery tracking — all hosted on your own server or local machine, with zero monthly SaaS fees.
Together, they give you a complete email campaign infrastructure:
Enter your email address, choose an account name, and set a password.
Provide billing information (a credit card is required for verification even for free-tier use).
Complete identity verification via phone.
Select the Free support plan.
Sign in to the AWS Management Console.
AWS Free Tier Note: New AWS accounts may receive promotional credits for some services. However, credits do not automatically remove SES sandbox restrictions or guarantee production sending access. Always verify your current account status in the Billing & Cost Management console.
4. Configure Amazon SES
Amazon SES requires you to verify your sending domain before you can send emails. This involves adding DNS records for SPF, DKIM, and optionally DMARC.
DNS propagation typically takes 15 minutes to 48 hours. Refresh the SES Identities page until the status shows Verified ✅.
Step 6 — Request Production Access (Exit Sandbox)
New SES accounts start in Sandbox mode — you can only send to pre-verified email addresses. To send to real subscribers:
In SES Console, click Account dashboard.
Click Request production access.
Fill in the form: describe your use case, estimated volume, bounce/complaint handling process.
Submit and wait for AWS approval (typically 1–3 business days).
Until production access is granted, you can test Plunk by verifying individual recipient email addresses under Configuration → Identities → Email address.
5. Understanding SPF, DKIM, and DMARC
These three authentication standards protect your domain's reputation and improve deliverability:
Standard
Purpose
DNS Record Type
SPF (Sender Policy Framework)
Declares which mail servers are authorized to send from your domain
TXT
DKIM (DomainKeys Identified Mail)
Digitally signs each email so recipients can verify it hasn't been tampered with
CNAME (via SES)
DMARC (Domain-based Message Authentication)
Tells receiving servers what to do when SPF/DKIM fails (none/quarantine/reject)
TXT
Without all three configured, your emails are significantly more likely to land in spam folders, regardless of your SES account status.
6. Create AWS IAM Credentials
Never use your AWS root account credentials for sending email. Create a dedicated IAM user with only the minimum required permissions.
Step 1 — Open IAM Console
In the AWS Console search bar, type IAM and open Identity and Access Management.
In the left menu, click Users → Create user.
Enter a username, e.g., plunk-ses-user.
Click Next.
Step 2 — Attach SES Permissions
Select Attach policies directly.
Search for and select AmazonSESFullAccess — or create a custom policy with only the minimum required actions:
On first launch, Plunk will prompt you to create your admin account.
8. Connect Amazon SES with Plunk
The connection between Plunk and Amazon SES is configured entirely through the .env file you set up in the previous step. Plunk uses the official AWS SDK with these exact environment variable names — do not rename them:
Variable
Description
Example
AWS_SES_REGION
AWS region where your SES identity is verified
us-east-1
AWS_SES_ACCESS_KEY_ID
IAM user access key ID
AKIA...
AWS_SES_SECRET_ACCESS_KEY
IAM user secret access key
wJalr...
SES_CONFIGURATION_SET
SES configuration set name for tracking
plunk-configuration-set
SES_CONFIGURATION_SET_NO_TRACKING
Config set for emails without open/click tracking
plunk-no-tracking-configuration-set
MAIL_FROM_SUBDOMAIN
Custom MAIL FROM subdomain (optional)
mail
Restart After Configuration Changes
Any time you modify .env:
docker compose down && docker compose up -d
Verify SES Is Working
Log into Plunk dashboard.
Go to Settings → Email.
Enter a verified email address (or any address if you have SES production access).
Additional columns become subscriber metadata (name, tags, etc.) depending on Plunk's import configuration.
Import Steps
In the Plunk dashboard, go to Contacts (or Subscribers).
Click Import or Add subscribers.
Upload your CSV file.
Map the email column to Plunk's email field.
Map any additional columns as desired.
Click Import.
Legal requirement: Only import email addresses of people who have explicitly given consent to receive marketing emails from your domain. Importing purchased lists or scraped addresses violates CAN-SPAM, GDPR, and AWS SES acceptable use policies — and can result in your SES account being suspended.
11. Create and Send an Email Campaign
In the Plunk dashboard, click Campaigns → New Campaign.
Campaign Name: An internal label (not visible to recipients).
Subject Line: The email subject your subscribers will see.
Email Body: Use Plunk's visual editor or HTML editor to design your campaign.
From Name & Address: Confirm it matches your verified sending domain.
Select Audience: Choose which contact list or segment to send to.
Send Test Email: Enter your own email address and send a test — verify it arrives and renders correctly in your inbox.
Launch: Click Send Campaign to send to the full audience.
Plunk uses a sending queue via Redis — large campaigns are dispatched progressively, respecting your SES sending rate limits.
Billing is per recipient, not per message. 1 email sent to 500 subscribers = 500 outbound emails billed.
Example: Sending 1,000,000 Emails
Cost Component
Pay-as-you-go
Notes
1,000,000 outbound emails
$100.00
$0.10 × 1,000 = $100
Attachment data (if any)
$0.12/GB
Optional, based on attachments
VPS server hosting
Varies
Separate from SES; your server cost
Domain + SSL
~$10–15/year
One-time annual cost
Total (emails only)
~$100
~₹8,300 for 1 million emails
This is a hypothetical cost estimate for illustration only. Your actual costs depend on your SES plan, usage volume, AWS region, data transfer, and any other AWS services used. Always verify current pricing at aws.amazon.com/ses/pricing.
SES Sandbox vs Production
Feature
Sandbox Mode
Production Mode
Send to unverified addresses
❌ No
✅ Yes
Default daily sending quota
200 emails/day
50,000+/day (scalable)
Max send rate
1 email/second
14+ emails/second (scalable)
How to activate
Default for new accounts
Request via SES Console
13. Email Deliverability and Anti-Spam Best Practices
High deliverability depends on your sending behavior as much as technical configuration. Follow these practices to protect your domain reputation:
Technical Authentication
✅ SPF: Add include:amazonses.com to your domain's TXT record
✅ DKIM: Use Easy DKIM (2048-bit RSA) via AWS SES — adds a digital signature to every email
✅ DMARC: Set p=quarantine or p=reject once you confirm SPF and DKIM are passing
Bounce and Complaint Management
Monitor your SES bounce rate — keep it below 2%
Monitor your complaint rate — keep it below 0.1%
Set up SES notifications via SNS to receive bounce and complaint webhooks automatically
Remove hard-bounced addresses from future sends immediately
Remove complainers from your list immediately
Unsubscribe
Always include a working unsubscribe link in every marketing email — Plunk handles this
Honor unsubscribe requests within 10 business days (legally required in most jurisdictions)
Consent
Only send to subscribers who have explicitly opted in to receive emails from your domain
Keep records of when and how consent was obtained
Never buy, scrape, or borrow email lists
Gradual Volume Warm-Up
When starting with a new domain/IP, begin with small volumes (100–500/day)
Gradually increase over 2–4 weeks
Sudden large-volume sends from a new domain trigger spam filters
Author
Paban Bhuyan
Founder, Webotapp Academy | AWS & DevOps Specialist
Founded Webotapp Academy in 2009 with 17+ years of experience in cloud infrastructure, AWS services, email deliverability, and full-stack web development. Has deployed AWS SES integrations for transactional email and bulk campaigns for clients across e-commerce, SaaS, and education verticals in 50+ countries.
Founded 2009Pioneering IT Training
50+ CountriesGlobal Client Footprint
17+ YearsAWS & Cloud Infrastructure
14. Conclusion
Combining Plunk (self-hosted email marketing platform) with Amazon SES (cloud email delivery infrastructure) gives you a production-grade email campaign system with:
₹0 in monthly SaaS fees — Plunk is free and open-source
~$0.10 per 1,000 emails — some of the lowest bulk email pricing available
Full data ownership — your subscribers, your server, your data
Contact import, visual editor, delivery tracking — all through Plunk's dashboard
The complete stack runs on any VPS (including Oracle Cloud's Always Free tier) with Docker Compose. Once your AWS SES account is approved for production sending and your domain is verified and warmed up, you have a scalable, cost-effective email infrastructure that grows with your audience.
QWhat are the correct environment variable names for AWS SES in Plunk?
Based on the official Plunk repository (.env.self-host.example and docker-compose.yml), the verified variable names are: AWS_SES_REGION, AWS_SES_ACCESS_KEY_ID, AWS_SES_SECRET_ACCESS_KEY, SES_CONFIGURATION_SET, and SES_CONFIGURATION_SET_NO_TRACKING. Do not rename or alter these — they are read directly by Plunk's AWS SDK integration.
QHow much does it cost to send 100,000 emails with AWS SES?
On the pay-as-you-go plan at $0.10 per 1,000 emails: 100,000 emails = $10.00 USD (approximately ₹830). This is the email sending cost only — your VPS hosting, domain, and any other AWS services are billed separately. Always verify current pricing at aws.amazon.com/ses/pricing as AWS may update their pricing tiers.
QCan I use Plunk with a Gmail or Outlook address as the sender?
No. Plunk sends email via Amazon SES, which requires a verified domain identity — not a public email address like Gmail or Outlook. You need a custom domain (e.g., yourdomain.com) that you control, so you can add the SES-provided DKIM CNAME records to its DNS settings. Sending from a public email provider's domain through SES would fail domain ownership verification.
QIs Plunk suitable for transactional emails as well as marketing campaigns?
Yes. Plunk supports both transactional (triggered) emails via its API and broadcast marketing campaigns through the dashboard. For transactional email (e.g., password resets, order confirmations), use the Plunk REST API from your application. For broadcast campaigns to subscriber lists, use the campaign builder in the dashboard. Both methods route through your configured AWS SES account.