Back to Details

amazon-ses

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Amazon SES

Amazon SES

Recommended: Use the AWS MCP Server with SES permissions for sandboxed execution and CloudTrail audit logging. Without MCP: All operations use standard AWS CLI syntax (
aws sesv2 ...
).
推荐：使用具备SES权限的AWS MCP Server进行沙箱执行和CloudTrail审计日志记录。 不使用MCP时：所有操作均采用标准AWS CLI语法（
aws sesv2 ...
）。

Overview

概述

This skill helps developers and DevOps engineers configure Amazon SES for production email sending. It targets users who are not email authentication experts — guiding them through complete domain setup following AWS best practices without requiring deep knowledge of DKIM, SPF, or DMARC.
本技能帮助开发者和DevOps工程师配置Amazon SES以用于生产环境邮件发送。它面向并非邮件认证专家的用户——引导他们遵循AWS最佳实践完成完整的域名设置，无需具备DKIM、SPF或DMARC的深入知识。

Routing

路由指引

If the user wants to...Read
Set up a domain for sending, configure email authentication, or troubleshoot DKIMSetting up SES domain identity
如果用户想要...阅读内容
设置发送域名、配置邮件认证或排查DKIM问题设置SES域名身份

Security

安全注意事项

  • Use IAM roles with ephemeral credentials (STS) — never long-lived access keys
  • Scope IAM permissions to specific SES actions per workflow (see reference files for required permissions)
  • Enable CloudTrail for SES API call auditing
  • DMARC 
    p=none
    is monitoring only — plan progression to 
    p=quarantine
    after confirming alignment
  • Never hardcode credentials, endpoints, or secrets in examples
  • 使用带有临时凭证（STS）的IAM角色——切勿使用长期访问密钥
  • 为每个工作流限定IAM权限至特定SES操作（参考文件中包含所需权限）
  • 启用CloudTrail以审计SES API调用
  • DMARC 
    p=none
    仅用于监控——在确认对齐后，计划逐步切换至
    p=quarantine
  • 切勿在示例中硬编码凭证、端点或密钥

Critical Rules

关键规则

  • MUST create a domain identity (not email identity) for production sending
  • MUST configure custom MAIL FROM subdomain for SPF alignment
  • MUST configure DMARC TXT record (
    p=none
    minimum) for domain alignment
  • MUST present all DNS records together in one batch
  • MUST ask user for preferred MAIL FROM subdomain (do not assume a default)
  • SHOULD check if Route 53 hosts the domain and offer automatic DNS creation
  • SHOULD NOT claim 72-hour wait — verification typically completes in minutes once DNS propagates
  • 必须创建域名身份（而非邮箱身份）以用于生产环境发送
  • 必须配置自定义MAIL FROM子域名以实现SPF对齐
  • 必须配置DMARC TXT记录（最低要求
    p=none
    ）以实现域名对齐
  • 必须一次性批量展示所有DNS记录
  • 必须询问用户偏好的MAIL FROM子域名（切勿假设默认值）
  • 应当检查Route 53是否托管该域名，并提供自动创建DNS记录的选项
  • 不应声称需要等待72小时——一旦DNS完成传播，验证通常在数分钟内完成

Additional Resources

附加资源