Warmy × Amazon SESWarmy Keeps Amazon SES Emails
Out Of Spam And Promotions
Amazon SES is cheap and scales well, and its own deliverability tools have improved a lot. It still won't warm up your domain for you, and it won't notice the DNS record you forgot to publish. That's where Warmy comes in. We warm the domain you send from, keep an eye on your authentication and sender health, and show you where your emails land before you scale up.
Free test · No credit card required · Connects with your SES SMTP credentials
Amazon SES Email Deliverability In 30 Seconds
When Amazon SES emails go to spam, SES itself is rarely the problem. It's usually the setup around it. The usual problems we see are a domain without its own DKIM, SPF that passes on amazonses.com but doesn't match your From address, and a missing DMARC record. A brand-new domain sent at full volume, or a list that keeps bouncing, will do it too. The good news is that DMARC only needs one of SPF or DKIM to pass and align, so aligned DKIM can carry you by itself. Fix authentication first. After that, warm up new domains and IPs slowly, watch your bounce rate (under 2%) and complaint rate (under 0.1%), and test inbox placement before every step up in volume.
- Authentication.
- Set up Easy DKIM and a custom MAIL FROM domain. DMARC you'll have to publish yourself, since SES never does.
- Reputation.
- The domain needs warming up, and so does the IP if you pay for a dedicated one. Bounce and complaint rates tell you how it's going.
- Visibility.
- SES reports delivery events, and since May 2026 it also estimates inbox placement. An independent test shows what your real sending path gets.
Why Amazon SES Emails Go To Spam: When "Delivered" Is Only The Handoff
Amazon Simple Email Service (SES) is the AWS service companies use to send email in bulk, from password resets to newsletters, over an API or SMTP. Its job is to get your message to the recipient's mail server and report back. What happens next is out of SES's hands. Gmail decides on its own whether the message goes to the inbox, Promotions or spam, and it bases that on things SES doesn't control. That's why Amazon SES deliverability problems rarely look like errors. Your logs are green. Your customers just never saw the email.
- What you see
- A Delivery event, but nobody can find the email
- What's usually going on
- SES logs Delivery when the receiving server accepts the message, and that's all it proves. A second later, the mailbox provider can still put it in spam.
- What you see
- SPF and DKIM pass, and placement is still bad
- What's usually going on
- Passing authentication only gets you in the door. Past that point, providers look at your reputation and at how recipients react to your mail. Plenty of perfectly authenticated mail ends up in junk.
- What you see
- A new domain or a new dedicated IP
- What's usually going on
- Mailbox providers don't trust strangers. Go from a few test sends to a full campaign overnight and you expose every problem that was hiding at low volume.
- What you see
- Bounces and complaints creeping up
- What's usually going on
- On SES this isn't only an inbox problem. Once bounces reach 5% or complaints reach 0.1%, AWS puts the account under review.
A free deliverability test will show you which of these applies to you.
Find The Amazon SES Deliverability Problem Before You Scale
**Warmy works next to SES and doesn't sit in your sending path. Everything you've built in Amazon SES stays where it is, and your team keeps sending the same way.**
Warm up your Amazon SES sending domain
SES will warm up a dedicated IP for you. The domain is left to you. That's the part Warmy handles: human-like conversations from your SES domain through a network of real mailboxes, with volume that climbs as placement improves. Mailbox providers get to know you before the big send does. Think of it as Amazon SES warm-up for the part SES skips.
Test Amazon SES inbox placement before you send
Send a real message through your SES setup and you'll see, for each provider, whether it reached the inbox, Promotions or spam. It's the path your production mail really takes. If something's off, change one thing and test again. The campaign goes out once placement holds.
Check authentication and domain health
We check whether SPF, DKIM and DMARC actually align, watch the blocklists, and catch the small DNS mistakes that make a setup look fine while it quietly underperforms.
Monitor reputation, then retest
If sender health starts to slip, Warmy alerts you. Fix the cause, run the same test again, and raise volume only after that.
How it works: test, diagnose, fix, retest
Send through Amazon SES.
Use exactly what your production traffic uses.
See what happened after the handoff.
Placement and sender health are broken down by mailbox provider.
Fix what's most likely wrong.
Authentication, reputation, an IP or domain switch, the list, or the content.
Retest.
Check that the fix worked before you scale.
Connect Amazon SES To Warmy In Three Steps
No code changes, no migration. Once your domain is verified in SES, setup takes a few minutes.
Get SMTP credentials from SES.
In the SES console, open SMTP settings and click Create SMTP credentials. Keep the username, password and endpoint somewhere safe, because you'll need them in the next step.
Add your sending address in Warmy.
Click Add Mailbox, pick Amazon SES, and enter your verified sender address with the SMTP details. Want warm-up replies to come back? Add an IMAP mailbox too.
Press start.
Warm-up, placement tests and monitoring begin the same day, and Warmy flags anything that fails on SPF, DKIM or DMARC.
Your domain needs to be verified in SES first. The authentication section further down walks through it, and the Help Center has the full connection guide with a short video.
Amazon SES SMTP settings for Warmy
| Setting | Value |
|---|---|
| SMTP endpoint | email-smtp.<region>.amazonaws.com, for example email-smtp.us-east-1.amazonaws.com. Use the region where your identity is verified |
| Port | 587 or 2587 with STARTTLS, or 465 / 2465 with TLS. Port 25 exists, but Warmy doesn't support it |
| Username / password | SES SMTP credentials from SMTP settings → Create SMTP credentials. These are not your AWS access keys |
| API or SMTP? | Both build the same domain reputation, so warm-up over SMTP also helps mail your app sends through the SES API |
Trusted By 35,000+ Ecommerce And B2B Senders
Teams that send transactional email at volume, ecommerce and lifecycle senders, agencies running client domains on SES, and engineers who'd rather get an independent read on deliverability than take a dashboard's word for it.
The platform’s warmup processes make sure that our cold emails don’t bounce into spam filters. It also makes use of AI behavior tracking as we’re sending which is great for campaigns scaling. It’s also really valuable to be able to track open rates and responses.
See where your next Amazon SES campaign lands.
No credit card required
How Amazon SES Deliverability Actually Works
SES takes a message from your application over the API or SMTP and tries to deliver it to the recipient's mail server. Every hop leaves a different trail of evidence. So when a customer says "I never got it", the trick is knowing which hop to look at.
| Stage | What it proves | Where to look |
|---|---|---|
| App to SES | Your application handed the message over | Your logs, the API or SMTP response, the SES message ID |
| SES handling | SES accepted, suppressed, delayed or rejected it | Events from a configuration set: send, delivery, delivery delay, bounce, complaint, reject |
| Recipient server | The receiving server accepted or refused it | The delivery or bounce event, with the server's own SMTP response |
| Mailbox | Inbox, Promotions or spam | SES Global Deliverability, a Warmy seed test, Google Postmaster Tools |
A Delivery event is the last thing SES can vouch for from the sending side. Everything after that is mailbox filtering, and that's where authentication, reputation and testing earn their keep.
How To Authenticate Your Amazon SES Sending Domain: SPF, DKIM And DMARC
Gmail, Yahoo and Microsoft want authenticated, aligned mail from bulk senders, and Amazon SES (AWS SES, if that's what you call it) will cheerfully send a perfectly formed, completely unauthenticated message. So it's on you. There are three DNS settings to get right under Verified identities. Before you start, remember that DMARC needs only SPF or DKIM to pass and align with your From domain. One aligned path is enough.
| Protocol | What SES does by default | The gap | What to publish |
|---|---|---|---|
| DKIM | Signs with its own amazonses.com domain | Nothing is signed with your domain until you set up DKIM for it | Easy DKIM: publish the 3 CNAME records SES generates (2048-bit key by default). BYODKIM and manual DKIM also exist |
| SPF | Uses a subdomain of amazonses.com as the MAIL FROM, and SPF passes against it | It passes, but it doesn't line up with your From domain, so DMARC doesn't count it | A custom MAIL FROM subdomain with one MX record and one SPF TXT record |
| DMARC | Nothing. SES never publishes it for you | No policy at all, and Gmail and Yahoo expect at least p=none from bulk senders | A TXT record at _dmarc.yourdomain.com, starting at p=none with a reporting address |
Amazon SES domain verification, DKIM and custom MAIL FROM setup, step by step
Verify a domain identity. Open Identities in SES, click Create identity and choose Domain. Verifying just an email address isn't enough, and an address identity can even override the domain's DKIM settings.
Turn on DKIM. On the identity's Authentication tab, edit DKIM, pick Easy DKIM and publish the 3 CNAME records. SES can take up to 72 hours to detect them.
Add a custom MAIL FROM domain. Use a subdomain that does nothing else, such as mail.yourdomain.com. It needs exactly one MX record plus the SPF TXT record SES gives you, v=spf1 include:amazonses.com ~all, which is your Amazon SES SPF record. A second MX record will break the setup. Also make sure the feedback MX never replaces the MX records that receive mail for your main domain.
Publish DMARC with p=none first. Add the record at _dmarc and read the aggregate reports for a while. Once every sender lines up, move to quarantine and then reject. Skip aspf=s: strict SPF alignment stops a custom MAIL FROM from aligning.
Check a real message. Send a test through SES to an outside mailbox and open the headers. Success looks like dkim=pass with d=yourdomain.com, plus dmarc=pass. An spf=pass on amazonses.com by itself doesn't count as success.
Repeat in every region you send from. Identities, DKIM and sandbox status are set per AWS region.
Seeing amazonses.com in your headers? That's SES's default MAIL FROM domain and its own DKIM signature. It just means the message went through SES. What you're fixing is alignment with your own domain. And copy the record values from your own SES console, never from a blog post (ours included). Once you connect, Warmy checks all three records and tells you what's failing. Got an email from complaints@email-abuse.amazonses.com? That's SES forwarding a spam complaint: a recipient marked one of your messages as spam, and it counts toward your complaint rate.
Want a quick check? Warmy's free SPF checker, DKIM checker and DMARC checker will read your records, and the email header analyzer takes a pasted message source.
Passing authentication doesn't guarantee the inbox
Authentication proves who sent a message. Whether anyone wants the message is a different question. That's down to reputation, engagement and the quality of your list, and a fully authenticated domain with no sending history can still end up in spam.
Amazon SES IP Warming: Shared vs Dedicated IPs, And Warming Your Domain
Authentication proves who you are. Warm-up proves you're worth trusting. On Amazon SES there are two things to warm: the sending domain, and the IPs if you pay for dedicated ones. People tend to remember the IPs and forget the domain.
| Shared IPs | Dedicated (standard) | Dedicated (managed) | |
|---|---|---|---|
| IP reputation | Pooled and managed by SES | Controlled by you | Controlled by you, with SES managing the IPs |
| IP warm-up | No manual IP warm-up | Automatic by default: time-based over 45 days, whatever your volume | Adaptive, handled by SES per mailbox provider |
| Best for | Low or irregular volume | High, predictable volume | High volume where you want less manual work |
| Watch out for | Less control over who shares the pool | Needs steady daily volume afterwards | Still depends on list quality and sending behavior |
AWS recommends shared IPs unless you send large volumes on a regular, predictable basis, and that advice is sound. A dedicated IP with too little traffic gives mailbox providers too little to learn from. Whichever route you pick, domain reputation is its own thing, and warming the domain is the job SES doesn't do for you.
How Amazon SES warm-up works with Warmy
Start at a low daily volume from your SES sending domain.
Real mailboxes open your messages, reply to them and rescue them from spam, which creates the engagement signals providers look for.
Volume ramps only as placement improves.
Placement tests confirm each stage before the next increase.
One more thing for new accounts. SES starts you in the sandbox: verified recipients only and a low daily cap. Once AWS approves production access, resist the urge to go all in. Ramp over several weeks and start with the people who actually open your mail.
Amazon SES Bounce And Complaint Rates: The Numbers AWS Acts On
| Metric | Aim for | AWS places the account under review | AWS may pause sending |
|---|---|---|---|
| Bounce rate (hard bounces to unverified domains) | Below 2% | 5% or more | 10% or more |
| Complaint rate | Below 0.1% | 0.1% or more | 0.5% or more |
These thresholds come from AWS itself, so treat them as hard limits. AWS calculates both rates over what it calls a "representative volume" of mail instead of a fixed time window. In practice, your console can be a step behind what recipients are already doing. The complaint rate also counts only complaints that reach SES through feedback loops. Providers that don't send feedback aren't in the figure, which is why Google Postmaster Tools earns a place in your setup. Gmail and Yahoo watch your spam rate too, and they want bulk senders below 0.3%.
One practical tip: have a configuration set publish your bounce and complaint events, and put CloudWatch alarms on both. Without them, SES has nothing to warn you about.
What Amazon SES Can Already See: VDM, Configuration Sets And CloudWatch
SES has added a lot of visibility in the last couple of years, and it's worth using all of it before you look elsewhere. An independent layer makes sense where those tools stop.
- Virtual Deliverability Manager (VDM).
- Your delivery, bounce, complaint, open and click numbers in one place, and an advisor that points out what to fix.
- Global Deliverability, new in May 2026.
- Inbox placement rates by sending domain and campaign, estimated from representative industry data samples, plus pre-send tests of candidate content at top mailbox providers and passive blocklist monitoring.
- Configuration sets and event publishing.
- You get an event for each message and pick where it goes, whether that's SNS, CloudWatch, Firehose or EventBridge.
- CloudWatch alarms.
- Put one on bounces and one on complaints.
- The account dashboard.
- It shows your account status as Healthy, Under review or Paused.
Which of these you get depends on your SES plan. In July 2026 AWS split SES into three plans. Essentials comes with deliverability insights. Pro adds managed dedicated IPs, email validation and global inbox placement visibility. Enterprise goes further, with multi-region resilience, workload-level reputation isolation and a yearly deliverability assessment.
Where Warmy Adds An Independent Layer
We're not trying to replace any of that. Warmy covers what SES can't do from the inside. From the outside, we test the path your mail actually takes. We also warm up the domain and keep an eye on authentication and sender health, and after every fix you can rerun the test.
| Need | Amazon SES | Warmy |
|---|---|---|
| Sending infrastructure, quotas, IPs | Core product | Works alongside it |
| Delivery, bounce, complaint, open and click metrics | VDM, reputation metrics, CloudWatch | Monitors and alerts on top |
| Inbox placement | Global Deliverability: placement rates by domain and campaign from sampled industry data, and pre-send content tests | Independent seed tests of your real sending path across Gmail, Outlook, Yahoo and Microsoft 365 |
| Domain warm-up with real engagement | IP warm-up for dedicated IPs | Gradual, engagement-led domain warm-up |
| SPF, DKIM, DMARC and blocklists | Identity status in the console, passive blocklist monitoring | Continuous validation, alerts and a fix-and-retest workflow |
| Human help | AWS Support plans; annual deliverability assessment on Enterprise | Certified deliverability specialists review your setup |
Amazon SES Email Deliverability Troubleshooting: What You See And What To Do
We've worked through a lot of SES setups, and the problems tend to repeat. Find the row that sounds like yours and start with the check in the third column.
| What you see | Likely area | What to check | Next action |
|---|---|---|---|
| SES shows Delivery, but the email is in spam | Placement or reputation | VDM, a real test and the message headers | Isolate the provider and retest (Warmy inbox placement test) |
| Some recipients have no SES event at all | Submission, sandbox, suppression or region | Message IDs in your logs, sandbox status in that region, suppression lists | Fix it in SES first. This isn't a placement problem |
| DKIM passes, DMARC fails | Alignment | The DKIM d= domain, your From domain, the MAIL FROM | Correct the alignment (Warmy DKIM and DMARC checkers) |
| SPF passes on amazonses.com | Default MAIL FROM | Whether you need SPF-based alignment | Consider a custom MAIL FROM (Warmy SPF checker) |
| Placement drops after a new dedicated IP | Warm-up | IP pool, warm-up status and volume | Slow the ramp and test |
| Gmail is weak, Outlook is fine | Provider-specific reputation | Placement by provider, Postmaster Tools | Segment the diagnosis (Warmy placement test) |
| Bounce rate climbs | List or data quality | SES reputation metrics, bounce subtypes | Suppress and validate bad recipients (Warmy email verification) |
| Complaint rate approaches 0.1% | Consent or relevance | Campaigns and audiences | Cut risky sending, talk to a specialist |
| Authentication passes, every provider is weak | Reputation, content or list | Sender-health signals and placement | Controlled remediation and warm-up |
| Transactional mail degrades after bulk sends | Stream mixing | Identities, configuration sets, IP pools | Separate streams by subdomain and configuration set |
Amazon SES Deliverability Checklist
Here are the Amazon SES deliverability best practices we'd work through, in this order.
0/12 ready
Three Common Amazon SES Situations And How To Handle Them
You've just been approved for production.
Before any real campaign, authenticate the domain and give it a warm-up. Then take several weeks to ramp, mailing your most engaged people first. Warmy runs that warm-up for you and retests placement at each new volume level.
SES says 99% delivered, but customers swear they never got the receipt.
Delivered only means accepted. A placement test plus a look at the headers usually explains it. The culprit tends to be DMARC misalignment or a domain that skipped warm-up. Sort out one of them and retest before you change anything else.
One bad campaign puts your password resets at risk.
AWS judges reputation for the account as a whole. That means one bad marketing send can take your transactional mail down with it. Separate sending subdomains and configuration sets keep the two apart, and it helps to monitor each domain on its own. If you want them fully isolated, use different AWS accounts (Enterprise customers also get workload-level isolation).
How we test Amazon SES inbox placement
Here's how our seed test works. One message goes through your SES setup to Warmy seed mailboxes at Gmail, Outlook, Yahoo, Google Workspace and Microsoft 365, and we record the folder it reached at each provider, including when it never arrived. After that we change a single thing, like the template or the volume, and repeat. Seed results are a sample, useful for diagnosing problems but not a promise about every inbox.
Amazon SES Email Deliverability: Frequently Asked Questions
When customers ask us this, the answer is usually authentication. Typically DKIM isn't set up for the domain yet, SPF only passes on amazonses.com, or there's no DMARC record. If authentication checks out, the next suspects are a cold domain sent at full volume and an old list that keeps bouncing. Check authentication, your SES reputation metrics and a real placement test to see which one applies. Warmy can run the placement test for you, check your records and warm up the domain.
Get authentication right first, which means DKIM, a custom MAIL FROM domain and DMARC. Warm up anything new slowly, whether it's a domain or an IP. After that, watch two numbers: bounces under 2% and complaints under 0.1%. Separating transactional and marketing mail helps, and so does a placement test before any big send.
Open the SES console, go to Identities and click Create identity, then choose Email address or Domain. An email address is verified through a link SES sends you. A domain is verified once SES finds the DNS records it gave you, at which point the status changes to Verified. SES will only send from verified identities, and while you're in the sandbox, the people you send to need to be verified as well. For authenticated mail, verify a domain.
Easy DKIM is the simplest route. You'll find it on the Authentication tab of your domain identity, under the DKIM settings. SES gives you 3 CNAME records (a 2048-bit key is the default), and once you've added them at your DNS provider, the status changes to Successful within 72 hours at most. If you'd rather bring your own key, BYODKIM is there too.
No. Either one is enough, as long as it passes and aligns with the domain in your From address. Set up both and you have a fallback if one of them breaks. On SES, Easy DKIM alone can get you a DMARC pass once it's aligned, and a custom MAIL FROM domain gives you SPF alignment too.
Mail yourself a test through SES at an address outside your company, then check the headers for dkim=pass on d=yourdomain.com and dmarc=pass. Warmy's free SPF, DKIM and DMARC checkers can read your records too, and after you connect SES, Warmy keeps checking all three and tells you when something fails.
You need one if you want SPF to satisfy DMARC. It's a small job: exactly one MX record and one SPF TXT record, on a subdomain you don't use for anything else. If your DKIM already aligns, DMARC will pass without it. We'd still set it up, since it gives you a second route to DMARC and a Return-Path domain you control.
Yes. Global Deliverability arrived in Virtual Deliverability Manager in May 2026. It estimates inbox placement rates by sending domain and campaign from representative industry data samples, and it can test candidate content before you send. Warmy complements that with independent seed tests of your real sending path, domain warm-up and authentication monitoring.
Most senders don't need one. AWS's own advice is to stay on shared IPs unless your volume is large and predictable. A standard dedicated IP gets warmed up automatically over 45 days, on a schedule set by time and not by volume. Managed dedicated IPs warm up adaptively, per mailbox provider. Your sending domain needs its own warm-up in both cases.
No. You pay based on your sending volume and on which AWS plan you're on: Essentials, Pro or Enterprise. Current rates and any new-customer credits are listed on the AWS pricing page.
No. SES is an active AWS service. AWS added Global Deliverability, with inbox placement metrics and blocklist monitoring, in May 2026 and introduced pricing plans in July 2026.
Stop Guessing Where Your Amazon SES Emails Land
Run one test with a real message sent through SES and see inbox, Promotions and spam by provider.
No credit card required · Cancel anytime