Knowledge Base Connect a provider Connect Amazon SES to RadarSend

Connect Amazon SES to RadarSend

Amazon SES (Simple Email Service) is AWS’s email sending service. This guide walks you through connecting it to RadarSend.

Before you begin#

  • An AWS account — sign up at https://aws.amazon.com if you don’t have one.
  • Access to your sending domain’s DNS (so you can add records at your DNS host or registrar).
  • A RadarSend account with admin access.

Step 1 — Get your Amazon SES credentials#

Do all of this inside a single AWS Region (for example, US East (N. Virginia)). SES is region-scoped, so everything below must live in the same region you’ll send from.

  1. Sign in to the AWS console and open Amazon SES. Use the region switcher in the top-right corner to pick the region you’ll send from, and keep that choice consistent.
  2. Verify your sending domain. Go to Amazon SES → Verified identities → Create identity → Domain, enter your domain, and create it. SES then shows a set of DKIM CNAME records (usually three). Open the identity’s Authentication tab, expand View DNS records if needed, and add those CNAME records to your domain’s DNS. Verification completes automatically once SES detects the records — this can take up to 72 hours, though it’s often much faster. (Check the current AWS console, as screens change over time.)
  3. Request production access (leave the SES sandbox). New SES accounts start in a sandbox where you can only send to addresses you’ve verified. In Amazon SES → Account dashboard, find the sandbox notice and choose Request production access, then fill in the short form (mail type, website URL, and how you’ll use SES). Most requests are answered within about 24 hours. Do this before you try to send to real recipients.
  4. Create an IAM user with access keys. RadarSend signs in to SES using an AWS access key pair.
    • Open the IAM console → Users → Create user, and give the user a name (for example, radarsend-ses).
    • On the permissions step, attach a policy that allows SES sending. RadarSend shows an IAM policy (JSON) you can copy in the credentials step of the connect wizard — attach exactly that policy so the permissions match what RadarSend needs (including the SNS permissions used for tracking in Step 3).
    • After the user is created, open it, go to the Security credentials tab, and under Access keys choose Create access key. Pick the Other use case if prompted, then create the key.
    • Copy the Access Key ID (starts with AKIA…) and the Secret Access Key. The secret is shown only once, so save it now. Also note the Region you’re working in.

Step 2 — Add the sending service in RadarSend#

  1. In RadarSend, go to Settings → Sending → Sending services and click + Connect a service.

  2. In the wizard, on Choose your sending service, pick Amazon SES, then click Continue.

  3. On Enter your Amazon SES keys, fill in:

    • AWS Region — must match the region where your SES domain is verified.
    • Access Key ID and Secret Access Key — the pair you copied in Step 1.
    • Configuration Set (optional) — leave blank to let RadarSend create one for you.

    This screen also shows the IAM policy to attach to your IAM user. If you haven’t already, use Copy policy JSON and attach it to that user. Then click Connect & verify. RadarSend runs a live connection test against SES and shows Connected when your keys work.

Step 3 — Turn on delivery, bounce & complaint tracking#

RadarSend sets this up for you. Open the service at Settings → Sending → Sending services → your service. In the Webhook delivery section, click Configure webhooks — RadarSend creates the Amazon SNS topic and subscription and points your SES configuration set’s event destination at RadarSend. Then click Check to confirm the Bounce, Spam Complaint, and Delivery triggers show as enabled. This step relies on the SNS permissions included in the IAM policy above, so make sure that policy is attached.

Step 4 — Confirm your sending address#

  1. Go to Settings → Sending → Senders and click + Add sender.
  2. Enter your Sending address, then click Continue. Add a Display name and Reply-to, pick which email types this sender handles, and click Continue.
  3. On Tracking & confirm, choose this service under Sending service (this only appears if you have more than one), enter a test recipient, and click Send test.
  4. When the test is accepted, click Save sender.

If the test is rejected because the domain isn’t authenticated, RadarSend offers Authenticate {domain} (DKIM/SPF) and shows the exact DNS records to add.

Common issues#

  • Still in the SES sandbox. In the sandbox you can only send to verified addresses, and volume is capped (about 200 messages/day). Request production access (Step 1) before sending to real recipients.
  • Region mismatch. This is one of the most common SES errors. Your access keys, the region you enter in RadarSend, and the region where your domain is verified must all match. Verifying a domain in one region does not verify it in another.
  • Domain not verified or DKIM not propagated. DNS changes can take time to spread. Confirm the DKIM CNAME records are present at your DNS host and that SES shows the identity as verified.
  • IAM policy missing SES or SNS permissions. If sending fails or webhook setup won’t complete, re-attach the exact policy RadarSend provides — it includes both the SES send and SNS tracking permissions.
  • Access keys inactive. In the IAM console, check that the access key’s status is Active, and that you pasted the full Secret Access Key without extra spaces.

Good to know#

  • SES is region-scoped: each region is effectively a separate SES account with its own verified identities, sandbox status, and sending quota.
  • SES charges per email. Check your current sending quota and rate limits on the Account dashboard in the SES console.