amazon-ses

Original：🇺🇸 English

Translated

Configures Amazon SES V2 for production email sending — including domain identity creation, DKIM/SPF/DMARC authentication, one-shot DNS record presentation, and Route 53 automation — for developers setting up or troubleshooting SES domain verification and deliverability. Applicable when developers need to send emails from their domain via SES, verify a domain identity, configure email authentication, troubleshoot DKIM verification issues, or ensure their sending setup follows best practices. Not for email-address-only verification, Mail Manager inbound routing, SNS, Pinpoint, or WorkMail.

3installs

Sourceaws/agent-toolkit-for-aws

Added on2026-08-11

NPX Install

npx skill4agent add aws/agent-toolkit-for-aws amazon-ses

SKILL.md Content

View Translation Comparison →

Amazon SES

Recommended: Use the AWS MCP Server with SES permissions for sandboxed execution and CloudTrail audit logging. Without MCP: All operations use standard AWS CLI syntax (
aws sesv2 ...
).

Overview

This skill helps developers and DevOps engineers configure Amazon SES for production email sending. It targets users who are not email authentication experts — guiding them through complete domain setup following AWS best practices without requiring deep knowledge of DKIM, SPF, or DMARC.

Routing

If the user wants to...	Read
Set up a domain for sending, configure email authentication, or troubleshoot DKIM	Setting up SES domain identity

Security

Use IAM roles with ephemeral credentials (STS) — never long-lived access keys
Scope IAM permissions to specific SES actions per workflow (see reference files for required permissions)
Enable CloudTrail for SES API call auditing
DMARC
```
p=none
```
is monitoring only — plan progression to
```
p=quarantine
```
after confirming alignment
Never hardcode credentials, endpoints, or secrets in examples

Critical Rules

MUST create a domain identity (not email identity) for production sending
MUST configure custom MAIL FROM subdomain for SPF alignment
MUST configure DMARC TXT record (
```
p=none
```
minimum) for domain alignment
MUST present all DNS records together in one batch
MUST ask user for preferred MAIL FROM subdomain (do not assume a default)
SHOULD check if Route 53 hosts the domain and offer automatic DNS creation
SHOULD NOT claim 72-hour wait — verification typically completes in minutes once DNS propagates