I tried the new "Mail Manager SMTP Guided Setup" feature in the Amazon SES console

Introduction

On July 24, 2026, a guided setup for Mail Manager SMTP was added to the Amazon SES console. By simply following the wizard, a complete set of traffic policies, rule sets, IAM roles, and ingress endpoints required for SMTP sending are created. This guided setup is available in all regions where SES is available.

https://aws.amazon.com/jp/about-aws/whats-new/2026/07/amazon-ses-simplified-smtp-mail-manager/

The SES SMTP settings screen displays both the traditional IAM SMTP credentials and the Mail Manager SMTP that is now covered by the guided setup. The main differences between the two are as follows.

Source: Creating SMTP credentials using Mail Manager / Obtaining Amazon SES SMTP credentials

The same documentation states that the use of Mail Manager is recommended.

We will walk through the process from setup and resource verification, to sending with Python, and confirming authentication results of received emails. The verification environment is as follows. Note that in this article, the sending domain has been replaced with the example example.com, and the latter parts of resource IDs and endpoint hostnames are masked.

Setup in the Console

Start the guided setup from "Create SMTP credentials" on the Mail Manager SMTP side.

Step 1: Credentials

Enter the ingress endpoint name and choose the authentication type. This time, "Password" was selected, and the password was generated using the console's "Auto-generate" option.

Step 2: Advanced Settings

Select "Create new" for the traffic policy and rule set, and create the IAM role by selecting "Create a new role." Additionally, specify the network type, IP address type, and TLS policy for the ingress endpoint.

The configuration values applied in this setup are as follows. The descriptions for network type, TLS policy, and IP address type are the text displayed on the screen.

The reason the description reads "emails sent to the domain" from a receiving perspective is that Mail Manager ingress endpoints were originally designed as entry points for receiving email. In this use case, the configuration involves the SMTP client connecting to this endpoint over the internet to relay email.

Step 3: Review

Review the credentials and advanced settings, then execute "Create credentials."

Setup Complete

Once the status becomes active, the endpoint hostname (ARecord) and username to specify in the SMTP client are displayed. The .csv file containing the password is downloaded from this screen. The lower part of the screen also provides setup instructions for SMTP clients using STARTTLS on port 587.

Verifying Created Resources (CLI)

We use the AWS CLI Mail Manager API to verify what was created by the wizard.

aws mailmanager list-ingress-points --region us-east-1

{
    "IngressPoints": [
        {
            "IngressPointName": "ingressendpoint-20260724-201901",
            "IngressPointId": "inp-4zdtzptathov...",
            "Status": "ACTIVE",
            "Type": "AUTH",
            "ARecord": "cdx6ee******.fips.****.mail-manager-smtp.amazonaws.com"
        }
    ]
}

Status is ACTIVE and Type is AUTH, indicating it was created as an ingress endpoint that accepts authenticated email from SMTP clients. The ARecord hostname is the connection destination to configure in the SMTP client.

aws mailmanager list-rule-sets --region us-east-1

{
    "RuleSets": [
        {
            "RuleSetId": "rs-5e7xcrj7pw6v...",
            "RuleSetName": "rule-set-20260724-202926",
            "LastModificationDate": "2026-07-25T05:31:01+09:00"
        }
    ]
}

aws mailmanager list-traffic-policies --region us-east-1

{
    "TrafficPolicies": [
        {
            "TrafficPolicyName": "traffic-policy-20260724-202926",
            "TrafficPolicyId": "tp-6woxwxztljlg...",
            "DefaultAction": "ALLOW"
        }
    ]
}

A summary of the names and IDs of the three automatically created resources.

In addition to the ingress endpoint, the rule set and traffic policy were also created upon wizard completion, so no separate creation steps were needed. The IAM role created at the same time is not a target of the Mail Manager API listing, so it is not covered here.

SMTP Connection and Sending Test

This is a minimal Python script that performs authentication and sending after STARTTLS encryption on port 587. Replace the hostname, username, and password with the values from the .csv downloaded on the completion screen before running.

import smtplib
from email.mime.text import MIMEText

SMTP_HOST = "<SMTP endpoint hostname>"
SMTP_PORT = 587
SMTP_USER = "<SMTP username>"
SMTP_PASSWORD = "<SMTP password>"
MAIL_FROM = "test@example.com"
MAIL_TO = "<Gmail address>"

msg = MIMEText("This is a test email sent from SES Mail Manager SMTP.")
msg["Subject"] = "SES Mail Manager SMTP Test"
msg["From"] = MAIL_FROM
msg["To"] = MAIL_TO

server = smtplib.SMTP(SMTP_HOST, SMTP_PORT)
server.set_debuglevel(1)
server.ehlo()
server.starttls()
server.ehlo()
server.login(SMTP_USER, SMTP_PASSWORD)
server.sendmail(MAIL_FROM, [MAIL_TO], msg.as_string())
server.quit()

In the EHLO before STARTTLS, STARTTLS and AUTH PLAIN LOGIN were presented, and authentication via AUTH PLAIN succeeded.

send: 'STARTTLS\r\n'
reply: b'220 Ready to start TLS\r\n'
...
reply: b'235 Authentication successful.\r\n'

send: 'ehlo [<client IP>]\r\n'
reply: b'250-****.mail-manager-smtp.amazonaws.com\r\n'
reply: b'250-8BITMIME\r\n'
reply: b'250-STARTTLS\r\n'
reply: b'250-AUTH PLAIN LOGIN\r\n'
reply: b'250 Ok\r\n'
reply: retcode (250); Msg: b'****.mail-manager-smtp.amazonaws.com\n8BITMIME\nSTARTTLS\nAUTH PLAIN LOGIN\nOk'
send: 'STARTTLS\r\n'
reply: b'220 Ready to start TLS\r\n'
reply: retcode (220); Msg: b'Ready to start TLS'
send: 'ehlo [<client IP>]\r\n'
reply: b'250-****.mail-manager-smtp.amazonaws.com\r\n'
reply: b'250-8BITMIME\r\n'
reply: b'250-AUTH PLAIN LOGIN\r\n'
reply: b'250 Ok\r\n'
reply: retcode (250); Msg: b'****.mail-manager-smtp.amazonaws.com\n8BITMIME\nAUTH PLAIN LOGIN\nOk'
send: 'AUTH PLAIN <credentials masked>\r\n'
reply: b'235 Authentication successful.\r\n'
reply: retcode (235); Msg: b'Authentication successful.'
send: 'quit\r\n'
reply: b'221 Bye\r\n'
reply: retcode (221); Msg: b'Bye'

In the EHLO after STARTTLS, STARTTLS was no longer presented, and only AUTH PLAIN LOGIN was offered. Email sending also succeeded, and receipt was confirmed on the Gmail side.

Received Email Header Verification

In this verification, the reverse lookup of the sending host was a host under smtp-out.amazonses.com. In Gmail's received headers, the communication from SES to Gmail during delivery used TLS1_3 (TLS_AES_128_GCM_SHA256).

Summary

With the guided setup for Mail Manager SMTP, all settings required for SMTP sending can now be created together.

If you are configuring SMTP sending from now on, we recommend avoiding the traditional IAM SMTP where possible. IAM SMTP requires creating an IAM user and a non-expiring access key for SMTP credentials, and the person performing the setup also needs IAM permissions at the access management level, such as iam:CreateUser and iam:PutGroupPolicy. There is also the operational overhead of deleting and recreating the IAM user whenever you want to change the password. The official documentation also recommends using Mail Manager.

With Mail Manager SMTP, no IAM user or access key is needed — you only need to manage the SMTP password or a Secrets Manager secret. With the password method used in this test, changes can be completed entirely from the ingress endpoint details screen. For environments already operating with IAM SMTP, if STARTTLS connections to Mail Manager SMTP are supported, we recommend taking this opportunity to migrate.

For information on SES pricing plans, please refer to the article below.

https://dev.classmethod.jp/articles/ses-pricing-plans-price-list-api-sesv2-api/