Guide
Connecting Amazon SES
Set up SES: IAM credentials or SMTP, the sandbox, verified identities, and the bounce feedback loop.
SES is the cheapest way to send at volume and the least forgiving about setup. Everything below is a step it will not let you skip.
Credentials
Two ways in, and they are the same service. IAM credentials speak to the API and let this product read verification status and manage identities for you. SMTP credentials are a username and password derived from an IAM user and send only.
Prefer IAM unless something in your network only speaks SMTP. Create them at https://console.aws.amazon.com/iam/home#/users.
Scope the IAM policy to SES. A credential that can do anything in the account is a credential worth stealing.
The sandbox
A new SES account is in a sandbox: it can only send to addresses you have verified, and its daily quota is small. Leaving it is a support request to AWS, in which they ask how you collect consent and what you do with bounces.
Answer honestly. This product enforces a warm-up ramp and a suppression ratchet, and saying so is a better answer than a promise.
Verify the domain, not each address
Verifying individual addresses does not scale and does not survive somebody leaving. Domain verification is three DKIM records, which this product can publish if a DNS provider is connected.
Set a custom MAIL FROM subdomain while you are there. It needs exactly one MX record and must not be shared with anything else -- including another relay, which cannot share the same label.
Bounces and complaints
SES reports these through SNS rather than a plain webhook. The subscription confirmation is handled for you; what you must do is make sure the topic exists and is attached to the configuration set.
Without that feedback the suppression list goes stale, and a stale suppression list is how a domain gets burnt.
Full API documentation: https://docs.aws.amazon.com/ses/latest/dg/send-email-api.html