WP Offload SES: Set Up Amazon SES for WordPress Email

Why Transactional Emails Matter More Than You Think

E-commerce receipts, login credentials, password resets — these are the emails your users actually need. If they're not landing in the inbox, your business loses credibility instantly. It's not glamorous, but transactional email is one of those infrastructure problems that will quietly tank your reputation if you ignore it.

A few years ago, this wasn't really a problem. Most people were on shared hosts like Bluehost or SiteGround, and those providers handled email as part of the package. You'd point your nameservers at the host and everything just worked. But the hosting landscape has shifted. Dedicated providers like Kinsta and Cloudways are excellent at serving websites, but they deliberately stay out of the email game — it's a completely different specialty.

That means your WordPress site can no longer send emails on its own. You need a dedicated transactional email provider to make sure signups, receipts, and notifications actually reach the inbox.

Why Amazon SES Is the Best Transactional Email Provider

Until recently, Mailgun was the go-to for transactional email because of its generous free tier. Predictably, they killed that plan — they've got to make money too. So where do you go now?

Amazon SES (Simple Email Service) sits in a rare sweet spot: it's both the best at what it does and the cheapest option available. Amazon has an excellent sending reputation, which translates directly into high deliverability for your emails.

The pricing is almost comically affordable. If you're hosting on Amazon EC2, you get 62,000 emails per month completely free — forever, not a limited-time offer. Even if you're not on EC2, the cost is just $0.10 per 1,000 emails. Run the numbers: 10,000 contact form submissions would cost you a grand total of one dollar per month. If you can't turn a profit on 10,000 leads with a $1 email bill, it might be time to rethink the business model.

Installing WP Offload SES on WordPress

Getting started is straightforward. Head to Plugins > Add New in your WordPress dashboard and search for "Offload SES." You're looking for the one made by Delicious Brains — that's the developer behind this plugin. Install and activate the free Lite version to get going.

Once activated, navigate to Settings > Offload SES Lite. One thing worth noting right away: Delicious Brains includes a solid step-by-step setup wizard right inside the plugin. It walks you through each stage of the configuration process, which is a nice touch for a free tool.

Creating an IAM User in AWS

The first real configuration step happens over in AWS, not WordPress. You need to create an IAM (Identity and Access Management) user that gives the plugin permission to send emails through SES.

Log into AWS and navigate to the IAM service. Go to Users, then click Add User. Give it a recognizable name and select Programmatic Access as the access type. On the permissions screen, choose "Attach existing policies directly" and search for "SES." Select the policy called Amazon SES Full Access.

After creating the user, you'll see an Access Key ID and a Secret Access Key. This is critically important: AWS only shows you the secret key once. You can either save it somewhere secure, or do what Dave does and just create a new IAM user whenever you need fresh credentials. Copy both keys — you'll need them in the next step.

Configuring Access Keys and Region Settings

Back in WordPress, the Offload SES setup wizard will ask for those access keys. You have two options for entering them: paste them directly into the plugin's settings fields, or add them to your wp-config.php file.

The wp-config approach is the recommended method because it's more secure. If someone gains access to your WordPress admin panel, they won't be able to see the keys stored in wp-config. If they got hold of your SES credentials, they could send emails from your account — racking up charges and potentially destroying your sending reputation with Amazon.

You'll also need to select an AWS region. Pick the one closest to your web server to minimize latency. For example, if your server is on the US West Coast, the Oregon region is a solid choice.

Getting Out of SES Sandbox Mode

New SES accounts start in what Amazon calls "sandbox mode." Despite the intimidating name, it's just Amazon's way of vetting new senders before giving them full access. In sandbox mode, you can only send emails to addresses on your own domain — essentially just test emails to yourself or coworkers.

To get out of sandbox, you'll submit a Sending Limit Increase request. Set the mail type to Transactional, enter your website URL, and answer two questions: who you'll be emailing (people who signed up through your site) and how you'll handle bounces and complaints (actively monitoring and removing bad addresses). Choose the same AWS region you selected in WordPress, set a daily sending quota of 25,000–50,000 emails to give yourself room to grow, and submit.

The approval process typically takes a day or two. If you ever outgrow your limit, just submit the form again for another increase.

Verifying Your Domain and Setting Up DKIM

The next step is domain verification, and while the plugin can handle this, there's an advantage to doing it manually through the SES console. Navigate to SES in AWS, click on Domains, and choose Verify a New Domain. Enter your domain name, but before clicking the button, check the box that says "Generate DKIM settings." DKIM is an email authentication protocol that significantly improves deliverability — don't skip it.

SES will generate a list of DNS records you need to add to your domain's DNS provider (GoDaddy, Cloudflare, or wherever you manage DNS). Add the TXT record and all three CNAME records. One important warning: do not touch the MX records. MX records control how you receive email, and changing them could break your existing email setup with Google Workspace, Rackspace, or whoever handles your inbox.

Back in the SES console, you can click the refresh button to check your verification status. The domain verification usually goes through quickly, but DKIM can take a few extra minutes — don't panic if it's not instant. Once both show as verified, head back to WordPress and complete the domain verification step there as well. The plugin will show you a TXT record, but it's the same one you already added, so you're already covered.

Finalizing Your WordPress Email Settings

With verification complete, configure your sending defaults in the plugin. Set the from email address and display name that will appear in your recipients' inboxes. You'll also configure email logging — the plugin can store logs for anywhere from 7 days to 2 years.

A quick tip: these logs track email opens and clicks, so keeping a longer retention period (a year or more) can be genuinely useful for troubleshooting. Make sure the "Send using SES" toggle is turned on, and enable both open tracking and click tracking.

Finally, send yourself a test email to confirm everything is working. If it lands in your inbox, you're all set — your WordPress site is now sending transactional emails through Amazon SES with proper authentication and solid deliverability.

WP Offload SES Pro: Is the Paid Version Worth It?

The free version handles the core job well, but the Pro version adds features that become genuinely valuable once your site has any real volume of users.

The standout feature is detailed email tracking. You get open and click reporting for every email sent through your site. This is incredibly useful in two scenarios: first, when users claim they never received an email — you can pull up the logs and see that they not only received it but clicked three links inside. Second, if you're running a membership site, you can monitor whether upgrade emails and onboarding sequences are actually getting opened and engaged with.

Pro also adds automatic retry for bounced emails. If a delivery fails because someone's inbox was full, the plugin will automatically try again a set number of times. You can also manually search through sent emails and resend specific ones. There's even an email preview feature so you can see exactly what any outgoing message looked like. Rounding it out, daily health reports give you a quick deliverability snapshot right in your inbox.

Watch the Full Video

Prefer watching to reading? Check out the full video on YouTube for a complete walkthrough with live demos and commentary.