Provider guide · Amazon SES
SES is the cheapest serious option by a wide margin, and the one with the most ceremony up front. Three things gate your first email: dedicated SMTP credentials, a verified sender identity, and an account still in the sandbox. All three are one-time hurdles.
1 · Credentials
SES gates your first email three times: a verified identity, production access, and dedicated SMTP credentials. In that order, because the order speeds up the approval.
Under Configuration, Identities, create a Domain identity. The default verification is Easy DKIM: AWS hands you three CNAME records to publish at your DNS provider, and the identity turns Verified once they propagate, up to 72 hours. Verifying the domain first is AWS’s own advice: it helps the production request coming next get approved faster.
New accounts live in a sandbox, per region. From the Account dashboard, choose Request production access: the form asks whether you send marketing or transactional email, transactional for WordPress, your website URL, and a confirmation that you handle bounces and complaints. AWS gives an initial answer within 24 hours.
Under SMTP settings in the left navigation, click Create SMTP credentials: AWS creates a dedicated IAM user and hands you a username and a password. Download the CSV or copy both values now, because the password is never shown again; lose it, and the path is delete the IAM user and create fresh credentials.
Two properties worth knowing. The username looks like an AWS access key ID, which is normal. And the password is derived per region: credentials made for eu-west-3 will be refused with an authentication error by us-east-1’s endpoint, and vice versa.
2 · In the plugin
The preset fills the port (587), the encryption (TLS) and a host in us-east-1. That host is the one field worth a second look.
email-smtp.<region>.amazonaws.com, where the region is the one your credentials and identities live in. Sending from Paris? Edit the preset value to email-smtp.eu-west-3.amazonaws.com.
The pair from the CSV you downloaded.
An address covered by a verified identity, exactly. An unverified From is rejected with “554 Email address is not verified”.
Save, then Send Test Email. While the account is in the sandbox, send the test to an address you have also verified, or it will bounce by design.
3 · Pitfalls
SES fails loudly and precisely, which is a gift once you can read the two errors that cover almost every case.
Every new SES account begins in the sandbox, per region: you can only send to verified addresses, capped at 200 messages per 24 hours and 1 per second. Leaving it is step 02 above; do it early, not the day of launch, because the 24-hour answer stretches when AWS has follow-up questions.
Almost always a region story: credentials generated in one region used against another region’s endpoint, since the SMTP password is derived per region. Check that the host’s region matches where you created the credentials. The other classic is pasting an AWS secret key instead of SES SMTP credentials.
The full response reads “554 Message rejected: Email address is not verified. The following identities failed the check in region…”: the From address, or the recipient while sandboxed, is not covered by a verified identity in that region. Verification does not travel: an identity verified in us-east-1 counts for nothing in eu-west-3. Verify the domain in the region you actually send from; the end of the message names the region it checked, which usually points straight at the mismatch.
If WordPress runs on ECS, Fargate or EC2, Custom SMTP can send through the SES API authenticated by the instance or task IAM role: no SMTP credentials, nothing stored in the database at all. That mailer, its environment variables and its IAM policy live on the developer page.
The email log keeps the exact error message the server returned, which is the fastest route to the cause. The documentation walks through the common ones.
There is a guide like this one for each of the twelve presets, from Gmail to Amazon SES, and the plugin takes any other SMTP server too.