Connect your AWS SES credentials

1. Create a dedicated IAM user

1. Sign in to the AWS Console as an administrator (not root for daily use).
2. Open IAM → Users → Create user.
3. Name it something like ecertify-mail-ses.
4. Enable Programmatic access only. Do not give console login.

2. Attach least-privilege SES permissions

Start with AmazonSESFullAccess to get sending working. For production, replace it with this custom policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ses:SendEmail",
        "ses:SendRawEmail",
        "ses:GetSendQuota",
        "ses:GetAccount",
        "ses:ListIdentities",
        "ses:GetIdentityVerificationAttributes",
        "ses:GetIdentityDkimAttributes"
      ],
      "Resource": "*"
    }
  ]
}

3. Create an access key

1. Open the IAM user → Security credentials.
2. Create access key → choose Application running outside AWS.
3. Copy the Access key ID and Secret access key once. AWS will not show the secret again.

4. Verify your sending domain in SES

1. Open Amazon SES → Identities in the same region you will use in Mail.
2. Create a domain identity (example: yourbrand.com).
3. Add the three DKIM CNAME records at your DNS provider. Do not duplicate the domain suffix.
4. Wait until the identity status is Verified.
5. If the account is still in sandbox, request production access in SES. Until AWS approves it, you can only send to verified email addresses.

5. Paste keys in Mail

1. Go to Settings → AWS SES.
2. Select the same region as your SES identities (Mumbai is ap-south-1).
3. Paste the access key and secret. Mail calls SES immediately to verify the keys.
4. If verification fails, the keys are not stored.
5. After the connection is saved, add the From addresses you want to send with. Pick a verified domain and enter one address per line, such as hello@yourbrand.com and support@yourbrand.com.

What Mail stores

• Access key ID (shown masked in the dashboard).
• Secret access key, encrypted with AES-256-GCM.
• Region, sandbox/production flag, and send quota from SES.

Disconnect anytime from Settings. That deletes the stored keys from Mail. It does not delete your AWS account.