Amazon SES

Amazon Simple Email Service (SES) is a cost-effective email delivery service. Entrig connects to SES using AWS IAM credentials and sends emails from your verified identity.

---

What you’ll need

• An AWS account with SES access
• An IAM user with the AmazonSESFullAccess policy (or a scoped policy that allows ses:SendEmail and ses:SendRawEmail)
• The IAM user’s Access Key ID and Secret Access Key
• At least one verified identity in SES: either a verified email address or a verified domain

SES accounts start in sandbox mode, which only allows sending to verified addresses. To send to any address, [request production access](https://docs.aws.amazon.com/ses/latest/dg/request-production-access.html) in your AWS console.

---

Configure

1. Open Channels → Email in Settings

   From the Entrig dashboard, go to Settings → Channels. Under the Email section, find Amazon SES and click Configure.

2. Enter your AWS credentials

   Enter your IAM user’s Access Key ID and Secret Access Key, and select the AWS Region where your SES identities are configured.

3. Click Connect

   Entrig calls the SES API to fetch your verified identities. If your credentials are correct, a success banner appears with the number of identities found.

4. Select a verified identity

   Choose a verified email address or domain from the dropdown. Only identities with sending enabled are shown.

5. Set the From address

   • If you selected a domain identity, enter the full From address (e.g. notifications@yourdomain.com). It must end with @yourdomain.com.
   • If you selected an email address identity, the From address is pre-filled automatically.

6. Set the From name (optional)

   Enter a display name that recipients will see (e.g. My App).

7. Save

---

IAM permissions

The IAM user needs at minimum:

{
  "Effect": "Allow",
  "Action": [
    "ses:SendEmail",
    "ses:SendRawEmail"
  ],
  "Resource": "*"
}

Entrig also calls ses:ListEmailIdentities during the Connect step to populate the identity selector. If you use a scoped policy, add that action, or enter your From email address manually after connecting.

---

Troubleshooting

”No verified identities found”

Cause: Your SES account has no verified email addresses or domains, or they are in a different region from what you selected.

Fix: Verify a domain or email address in the SES console and make sure the selected region matches.

Emails land in spam

Cause: Your domain does not have SPF, DKIM, or DMARC records configured.

Fix: Follow the SES domain verification guide to add the required DNS records. SES will show a DKIM status of “Verified” once the records propagate.

”SES API error: 403”

Cause: The IAM credentials do not have permission to call SES.

Fix: Attach the AmazonSESFullAccess policy to the IAM user, or add the specific actions listed above.