Connecting Amazon SES to n8n: sending email at scale and closing the bounce loop via SNS

n8n's Send Email node does the job over SMTP, and Resend adds handy status webhooks — but neither holds up on cost once volume climbs. Amazon SES charges roughly $0.10 per 1,000 emails, with no subscription or tier, making it the cheapest building block on the market for transactional email at scale. n8n ships a native AWS SES node covering the essentials: simple sends, template-based sends, template management, and — paired with the AWS SNS Trigger node — a genuine feedback loop on bounces and complaints. This guide covers credential setup, exiting sandbox mode, and that SNS loop most tutorials skip.

Creating a dedicated IAM credential

n8n uses the generic AWS credential, with three fields: Region (where your SES identity is verified, e.g. eu-west-1), Access Key ID and Secret Access Key. Support for temporary credentials (STS, with a Session Token) is also available if your organization requires automatic rotation.

Create an IAM user dedicated to n8n — never your root account or a key shared with other services. The policy should stay strictly scoped to sending:

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": ["ses:SendEmail", "ses:SendTemplatedEmail"],
    "Resource": "*"
  }]
}

This follows the same discipline as good API credential management practices: an IAM key that can only send email strictly limits the damage if it leaks from a workflow or a poorly protected export.

The AWS SES node's three resources

The n8n-nodes-base.awsSes node organizes its operations around three resources.

Email — the everyday use. The Send operation takes From Email, To Addresses, Subject, Message (with an HTML/plain-text toggle) and useful additional fields: CC/BCC, Reply To, and crucially Configuration Set Name, the parameter that ties this send to bounce tracking (more on that below). The Send Template operation replaces subject and body with an existing Template Name plus personalization data to inject.

Template — Create, Get, Get Many, Update, Delete. An SES template is defined by a name, a subject (Subject Part), an HTML version (HTML Part) and an optional plain-text version. Managing your templates from n8n lets you regenerate them automatically from a CMS or a spreadsheet, instead of copying them by hand into the AWS console.

Custom Verification Email — a niche resource that sends a custom verification email (with your own template and your own redirect pages) to an address you want to promote to verified-identity status, rather than AWS's generic default email.

Exiting sandbox mode

Every new SES account starts in sandbox mode, with three strict restrictions: a maximum of 200 emails per 24-hour period, a rate capped at one email per second, and a requirement to send only to addresses or domains explicitly verified — including the recipient, not just the sender. That's enough to validate an n8n workflow end to end using your own address, but unusable in production.

Two steps before flipping the switch:

1. Verify your sending domain. In the SES console, add the provided DNS records (CNAMEs for Easy DKIM, plus SPF and ideally DMARC). It's the same logic as for any transactional send: without aligned DKIM and SPF, messages leave with degraded sender reputation regardless of the tool used.
2. Request production access. The form lives in the SES console (Account dashboard → Request production access): describe your use case, how you handle bounces, and your expected volume. The answer usually arrives within 24 hours. Once granted, the default quota often starts at several tens of thousands of emails per day and increases automatically as long as your sending reputation stays healthy.

Closing the bounce and complaint loop with AWS SNS Trigger

This is the part most SES setups miss: without a feedback mechanism, an email that bounces (nonexistent address) or triggers a spam complaint disappears silently, and your sender reputation degrades without your knowledge.

The AWS mechanics: an SES configuration set can publish every Bounce and Complaint event to an SNS topic. On the n8n side, all that's needed is an AWS SNS Trigger node pointed at that topic. The notable detail is that n8n handles the SNS subscription confirmation on its own (the SubscriptionConfirmation message AWS sends to the endpoint) — no manual click on a confirmation link, no extra HTTP Request node to call ConfirmSubscription.

Four-step setup:

1. SES console → Configuration sets → create a set, e.g. n8n-transactional.
2. In that set, add an Event publishing destination of type SNS, check Bounce and Complaint, and point it at an SNS topic created for the purpose.
3. In n8n, add an AWS SNS Trigger node and select that topic (by list, by URL, or by ARN).
4. On the sending node (Send or Send Template operation), set Configuration Set Name to the name chosen in step 1 — without this field, the event is never published.

The resulting workflow is short: an If node that separates Type: Bounce (and among those, bounceType: Permanent, the true hard failures) from Type: Complaint, then a write to your database to flag the address as invalid before any future send. It's exactly the logic Resend reaches with its Svix webhooks, carried over to the AWS world.

Use cases that justify the move to SES

High-volume digests and notifications. An Inbox AI Pack sending a daily digest to hundreds of recipients, or an SMB notifying customers at every order step, quickly outgrows the economics of Resend or a paid SMTP service. At 50,000 emails a month, SES costs about $5; most competitors charge a fixed monthly subscription well above that volume's actual usage.

Automatically generated invoices and confirmations. An SES template for order confirmation, another for the invoice, fed by data from a Set node upstream — generating the PDF itself remains the job of a dedicated quote/invoice node.

Compliant re-engagement on large lists. A re-engagement campaign to a list of several thousand contacts, with immediate handling of unsubscribes and hard bounces to stay under the 0.3% complaint threshold Gmail and Yahoo now require for bulk senders.

Security and deliverability: verify, don't assume

The temptation, once SES is configured, is to consider the topic closed. Two large-scale email measurement studies argue for caution. Dennis Tatang, Florian Zettl and Thorsten Holz, in The Evolution of DNS-based Email Authentication: Measuring Adoption and Finding Flaws (RAID 2021 — see on Google Scholar), show that despite a tenfold increase in adoption over five years, DMARC still covers only about 11% of the domains analyzed — and that misconfigured policies (too permissive, or pointing to reports nobody ever reads) remain common. Md. Ishtiaq Ashiq, Weitong Li, Tobias Fiebig and Taejoong Chung, in You've Got Report: Measurement and Security Implications of DMARC Reporting (USENIX Security 2023 — see on Google Scholar), go further: even among domains that publish a DMARC policy, the aggregate reports sent back are very often mishandled or never reviewed at all, which empties the mechanism of its practical value.

The lesson for an SES setup: publishing DKIM and SPF records isn't enough if nobody ever reviews the DMARC reports or the SNS bounces they flag. The loop described above — configuration set, SNS topic, AWS SNS Trigger — isn't a nice-to-have; it's what turns a correct DNS configuration into a system that actually reacts when something degrades.

Summary

Amazon SES makes sense once transactional email volume outgrows what a plain SMTP setup or a service like Resend can absorb at reasonable cost. On the n8n side: a narrowly scoped IAM credential (ses:SendEmail alone), the Email/Template/Custom Verification Email resources of the AWS SES node, exiting sandbox mode through DNS domain verification and a production access request, and above all an SES configuration set tied to an SNS topic that the AWS SNS Trigger node consumes with no manual handshake configuration.

Going further

If the goal is to automate your inbox's entire lifecycle — not just sending — the Inbox AI Pack (€79) covers AI-based triage of incoming emails, urgency scoring and the daily digest, a natural upstream step before an SES sending layer. And if your transactional emails are part of a process that needs to stay traceable (consent, proof of delivery, follow-ups), the Compliance & Audit Pack (€149) provides the timestamped audit trail documenting who received what, and when.