I tried the new "Mail Manager SMTP Guided Setup" feature in the Amazon SES console

Introduction

On July 24, 2026, a guided setup for Mail Manager SMTP was added to the Amazon SES console. By simply following the wizard, a complete set of traffic policies, rule sets, IAM roles, and ingress endpoints required for SMTP sending are created. This guided setup is available in all regions where SES is available.

https://aws.amazon.com/jp/about-aws/whats-new/2026/07/amazon-ses-simplified-smtp-mail-manager/

The SES SMTP configuration screen displays both the traditional IAM SMTP credentials and the Mail Manager SMTP that is now covered by the guided setup. The main differences between the two are as follows.

Source: Creating SMTP credentials using Mail Manager / Obtaining Amazon SES SMTP credentials

The same documentation states that the use of Mail Manager is recommended.

This article walks through the process from setup and resource verification to sending with Python and checking authentication results on received emails. The test environment is as follows. Note that in this article, the sending domain is replaced with the example domain example.com, and the latter parts of resource IDs and endpoint hostnames are masked.

Setup in the Console

Start the guided setup from the "Create SMTP credentials" option on the Mail Manager SMTP side.

Step 1: Credentials

Enter the ingress endpoint name and select the authentication type. This time, "Password" was selected, and the password was generated using the console's "Auto-generate" option.

Step 2: Advanced Settings

Select "Create new" for the traffic policy and rule set, and create the IAM role by selecting "Create a new role". Additionally, specify the network type, IP address type, and TLS policy for the ingress endpoint.

The configuration values applied in this setup are as follows. The descriptions for network type, TLS policy, and IP address type are the text displayed on the screen.

The description "mail sent to the domain" is written from a receiving perspective because the Mail Manager ingress endpoint was originally designed as an entry point for receiving mail. In this use case, the configuration involves an SMTP client connecting to this endpoint over the internet to deliver mail.

Step 3: Review

Review the credentials and advanced settings, then execute "Create credentials".

Setup Complete

Once the status becomes active, the endpoint hostname (ARecord) and username to specify in the SMTP client are displayed. The .csv file containing the password is downloaded from this screen. The bottom of the screen also provides setup instructions for SMTP clients using STARTTLS on port 587 or TLS on port 465.

Verifying Created Resources (CLI)

Use the AWS CLI Mail Manager API to check what was created by the wizard.

aws mailmanager list-ingress-points --region us-east-1

{
    "IngressPoints": [
        {
            "IngressPointName": "ingressendpoint-20260724-201901",
            "IngressPointId": "inp-4zdtzptathov...",
            "Status": "ACTIVE",
            "Type": "AUTH",
            "ARecord": "cdx6ee******.fips.****.mail-manager-smtp.amazonaws.com"
        }
    ]
}

The Status is ACTIVE and the Type is AUTH, indicating that the ingress endpoint was created to accept mail with authentication from SMTP clients. The ARecord hostname is the connection destination to configure in the SMTP client.

aws mailmanager list-rule-sets --region us-east-1

{
    "RuleSets": [
        {
            "RuleSetId": "rs-5e7xcrj7pw6v...",
            "RuleSetName": "rule-set-20260724-202926",
            "LastModificationDate": "2026-07-25T05:31:01+09:00"
        }
    ]
}

aws mailmanager list-traffic-policies --region us-east-1

{
    "TrafficPolicies": [
        {
            "TrafficPolicyName": "traffic-policy-20260724-202926",
            "TrafficPolicyId": "tp-6woxwxztljlg...",
            "DefaultAction": "ALLOW"
        }
    ]
}

A summary of the names and IDs of the three automatically created resources is shown below.

The rule set and traffic policy were created at the time the wizard completed, along with the ingress endpoint, so no separate creation steps were needed. The IAM role created at the same time is not listed by the Mail Manager API and is therefore not covered here.

SMTP Connection and Sending Test

The following is a minimal Python script that authenticates and sends mail after STARTTLS encryption on port 587. Replace the hostname, username, and password with the values from the .csv downloaded on the completion screen before running.

import smtplib
from email.mime.text import MIMEText

SMTP_HOST = "<SMTP endpoint hostname>"
SMTP_PORT = 587
SMTP_USER = "<SMTP username>"
SMTP_PASSWORD = "<SMTP password>"
MAIL_FROM = "test@example.com"
MAIL_TO = "<Gmail address>"

msg = MIMEText("This is a test message sent via SES Mail Manager SMTP.")
msg["Subject"] = "SES Mail Manager SMTP Test"
msg["From"] = MAIL_FROM
msg["To"] = MAIL_TO

server = smtplib.SMTP(SMTP_HOST, SMTP_PORT)
server.set_debuglevel(1)
server.ehlo()
server.starttls()
server.ehlo()
server.login(SMTP_USER, SMTP_PASSWORD)
server.sendmail(MAIL_FROM, [MAIL_TO], msg.as_string())
server.quit()

In the EHLO before STARTTLS, STARTTLS and AUTH PLAIN LOGIN were presented, and authentication via AUTH PLAIN succeeded.

send: 'STARTTLS\r\n'
reply: b'220 Ready to start TLS\r\n'
...
reply: b'235 Authentication successful.\r\n'

send: 'ehlo [<client IP>]\r\n'
reply: b'250-****.mail-manager-smtp.amazonaws.com\r\n'
reply: b'250-8BITMIME\r\n'
reply: b'250-STARTTLS\r\n'
reply: b'250-AUTH PLAIN LOGIN\r\n'
reply: b'250 Ok\r\n'
reply: retcode (250); Msg: b'****.mail-manager-smtp.amazonaws.com\n8BITMIME\nSTARTTLS\nAUTH PLAIN LOGIN\nOk'
send: 'STARTTLS\r\n'
reply: b'220 Ready to start TLS\r\n'
reply: retcode (220); Msg: b'Ready to start TLS'
send: 'ehlo [<client IP>]\r\n'
reply: b'250-****.mail-manager-smtp.amazonaws.com\r\n'
reply: b'250-8BITMIME\r\n'
reply: b'250-AUTH PLAIN LOGIN\r\n'
reply: b'250 Ok\r\n'
reply: retcode (250); Msg: b'****.mail-manager-smtp.amazonaws.com\n8BITMIME\nAUTH PLAIN LOGIN\nOk'
send: 'AUTH PLAIN <credentials masked>\r\n'
reply: b'235 Authentication successful.\r\n'
reply: retcode (235); Msg: b'Authentication successful.'
send: 'quit\r\n'
reply: b'221 Bye\r\n'
reply: retcode (221); Msg: b'Bye'

In the EHLO after STARTTLS, STARTTLS was no longer presented and only AUTH PLAIN LOGIN appeared. The mail was sent successfully and receipt was confirmed on the Gmail side.

Received Email Header Check

In this test, the reverse lookup of the sending host resolved to a host under smtp-out.amazonses.com. In the Gmail received headers, the communication from SES to Gmail during delivery used TLS1_3 (TLS_AES_128_GCM_SHA256).

Summary

The guided setup for Mail Manager SMTP now allows all the settings required for SMTP sending to be created together.

If you are configuring SMTP sending from scratch, there is no reason to choose the traditional IAM SMTP. The IAM SMTP method requires creating an IAM user and a non-expiring access key for SMTP credentials, and the person performing the setup needs IAM permissions at the access management level, such as iam:CreateUser and iam:PutGroupPolicy. The operational practice of deleting and recreating the IAM user whenever you want to change the password also remains. The official documentation also recommends Mail Manager.

With Mail Manager SMTP, no IAM user or access key is needed—you only need to manage the SMTP password or a Secrets Manager secret. With the password method tested here, changes can be completed entirely from the ingress endpoint detail screen. For environments already running on IAM SMTP, the main migration work is simply replacing the connection hostname and credentials. This is a good opportunity to consider making the switch.

For information about SES pricing plans, please refer to the article below.

https://dev.classmethod.jp/articles/ses-pricing-plans-price-list-api-sesv2-api/