---
title: Amazon SES
description: Configure Amazon SES as an email provider in Notiflows
---

Amazon Simple Email Service (SES) is a cost-effective email service built on AWS infrastructure.

## Prerequisites

Before configuring SES in Notiflows, you need:

1. An [AWS account](https://aws.amazon.com)
2. A verified sending identity (domain or email address)
3. An IAM user with SES send permissions
4. SES moved out of sandbox mode if you need to send to unverified recipients

## Configuration

| Field | Required | Description |
|-------|----------|-------------|
| Region | Yes | The AWS region where SES is configured (e.g., `us-east-1`) |
| Access Key ID | Yes | IAM user access key |
| Secret Access Key | Yes | IAM user secret key |
| From Email | Yes | A verified sender email address or an address on a verified domain |
| From Name | No | Display name shown to recipients (e.g., `My App`) |

## Step 1: Verify a sender identity

SES requires you to verify the domain or email address you send from. Domain verification is recommended for production because it covers all addresses on that domain.

### Option A: Verify a domain (recommended)

1. Open the [Amazon SES console](https://console.aws.amazon.com/ses/)
2. In the left navigation, under **Configuration**, click **Identities**
3. Click **Create identity**
4. Select **Domain** as the identity type
5. Enter your domain (e.g., `example.com`)
6. Under **Verifying your domain**, leave **Easy DKIM** selected and choose **RSA_2048_BIT** as the signing key length
7. Click **Create identity**

SES generates three CNAME records for DKIM authentication. You need to add these to your domain's DNS:

1. On the identity details page, click the **Authentication** tab
2. Expand **Publish DNS records** — you'll see three CNAME records
3. Add each record to your DNS provider (or click **Download .csv record set** to export them)
4. Wait for DNS propagation — the **Identity status** changes to **Verified** once SES detects the records (usually a few minutes, can take up to 72 hours)

<Callout>
If you use Amazon Route 53 for DNS, SES can publish the records automatically. Check the **Publish DNS records to Route53** option during identity creation.
</Callout>

### Option B: Verify an email address

Use this for quick testing or if you don't own the sending domain.

1. Open the [Amazon SES console](https://console.aws.amazon.com/ses/)
2. In the left navigation, under **Configuration**, click **Identities**
3. Click **Create identity**
4. Select **Email address** as the identity type
5. Enter the email address you want to send from
6. Click **Create identity**
7. Check your inbox for an email from `no-reply-aws@amazon.com` and click the verification link

The identity status updates to **Verified** within a few minutes.

## Step 2: Move out of sandbox mode

New SES accounts start in sandbox mode, which limits sending to verified email addresses only. For production use, you need to request production access.

1. Open the [Amazon SES console](https://console.aws.amazon.com/ses/)
2. In the left navigation, click **Account dashboard**
3. At the top you'll see a banner: "Your Amazon SES account is in the sandbox"
4. Click **View Get set up page**, then **Request production access**
5. Fill in the form:
   - **Mail Type** — select **Transactional**
   - **Website URL** — your application's URL
   - **Additional Contacts** — email addresses for account communications
   - Acknowledge that you'll only send to recipients who have opted in and that you handle bounces and complaints
6. Click **Submit request**

AWS typically responds within 24 hours.

## Step 3: Create an IAM user

Notiflows needs an IAM access key with permission to send email through SES. Create a dedicated IAM user rather than using root account credentials.

### Create the IAM policy

1. Open the [IAM console](https://console.aws.amazon.com/iam)
2. In the left navigation, click **Policies**
3. Click **Create policy**
4. Click the **JSON** tab and paste the following:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ses:SendEmail",
        "ses:SendRawEmail"
      ],
      "Resource": "*"
    }
  ]
}
```

5. Click **Next**
6. Name the policy (e.g., `NotiflowsSESSendEmail`)
7. Click **Create policy**

To restrict sending to a specific verified identity, replace `"Resource": "*"` with your identity ARN:

```json
"Resource": "arn:aws:ses:us-east-1:123456789012:identity/example.com"
```

You can find your identity ARN on the identity details page in the SES console.

### Create the user and attach the policy

1. In the IAM console, click **Users** in the left navigation
2. Click **Create user**
3. Enter a user name (e.g., `notiflows-ses`)
4. Do **not** check "Provide user access to the AWS Management Console" — Notiflows only needs programmatic access
5. Click **Next**
6. Select **Attach policies directly**
7. Search for the policy you created (`NotiflowsSESSendEmail`) and check it
8. Click **Next**, then **Create user**

### Generate access keys

1. Click on the user you just created to open the user details
2. Go to the **Security credentials** tab
3. Scroll to **Access keys** and click **Create access key**
4. Select **Third-party service** as the use case
5. Check the acknowledgment and click **Next**, then **Create access key**
6. Copy the **Access Key ID** and **Secret Access Key**

<Callout>
The secret access key is only shown once. Copy it now and store it securely. If you lose it, you'll need to create a new access key pair.
</Callout>

## Step 4: Choose a region

SES is a regional service. The region you choose in Notiflows must match the region where your verified identities are configured. Pick the region closest to your users for lower latency.

| Region | Location |
|--------|----------|
| `us-east-1` | N. Virginia |
| `us-west-2` | Oregon |
| `eu-west-1` | Ireland |
| `eu-central-1` | Frankfurt |
| `ap-southeast-1` | Singapore |
| `ap-southeast-2` | Sydney |

## Step 5: Set up in Notiflows

1. Navigate to **Channels** in your project
2. Click **Create Channel**
3. Select **Email** as the channel type
4. Select **Amazon SES** as the provider
5. Select your **Region**
6. Enter your IAM **Access Key ID** and **Secret Access Key**
7. Enter your verified **From Email** and optionally a **From Name**
8. Save the channel

## Templates

Email templates support three content types:
- **Visual** - Drag-and-drop editor for rich HTML emails
- **HTML** - Raw HTML with full control
- **Plaintext** - Simple text emails

Use Liquid templating for dynamic content:

```liquid
Hi {{ recipient.first_name }},

{{ data.message }}

Best,
{{ actor.first_name }}
```

Available variable contexts:
- `recipient.*` - Recipient user data (first_name, last_name, email, etc.)
- `actor.*` - User who triggered the notification
- `data.*` - Custom payload passed when triggering the notiflow