Stop WordPress Emails Going to Spam: A Step-by-Step Amazon SES WordPress Setup Guide

The Essential Guide to Amazon SES WordPress Setup (and Why Your Emails Deserve Better).

If you have ever submitted a contact form on your own website and the response never arrived, you already understand the problem. Most WordPress sites send email the same way they have for years – through the web server’s built-in mail function. It works just well enough to feel reliable, right up until a critical form submission vanishes or a password reset link never shows up. For marketing directors and business owners, that is not a minor inconvenience. It is lost revenue, lost trust, and a support headache that never needed to happen. A proper Amazon SES WordPress setup replaces that fragile default with infrastructure built specifically for sending email at scale – and getting it delivered.

Email Deliverability WordPress Issue:

The core issue is reputation. Email providers like Gmail and Outlook decide whether your message lands in the inbox or the spam folder based on a set of authentication signals tied to your domain. When WordPress sends mail through your web server, those signals are either missing or weak. Amazon Simple Email Service (SES) solves this by routing your site’s email through a verified, authenticated sending infrastructure that major inbox providers actually trust.

If your contact form confirmations and internal notifications are landing in spam, the problem is almost never the content. It is the plumbing.

Amazon SES is a cloud-based email sending service from AWS. Unlike your web host’s mail server, SES is purpose-built for deliverability. It handles authentication protocols like DKIM and DMARC on your behalf, maintains sender reputation at a platform level, and scales to handle anything from a handful of form notifications to thousands of marketing emails. For our {Site Management} clients, it is the standard we recommend because it offers enterprise-grade deliverability without enterprise-grade complexity.

What other WordPress SMTP Configuration exist?

There are other SMTP services out there – SendGrid, Mailgun, Postmark – and they are all solid. We lean toward SES for a few reasons. The pricing is straightforward and extremely low for typical WordPress volumes. For estimating email sending cost, you can visit and calculate {Amazon SES Calculator}. The integration with the broader AWS ecosystem is useful for clients who already use AWS hosting or services. And once the Amazon SES WordPress setup is complete, it tends to just work quietly in the background, which is exactly what email infrastructure should do.

This is a technical setup, and if you are a marketing director reading this, the goal is not necessarily for you to do it yourself. It is for you to understand what is happening and why, so you can have an informed conversation with your developer or your agency. If you work with No Panic Design through our {Design & Build} service, this is something we handle as part of the launch process.

That said, here is what the setup requires:

– An AWS account with access to the Amazon SES console
– AWS Simple Email Service with Production Access (not Sandbox Mode), if you are in Sandbox Mode, please first submit a request to AWS Support {link to article}
– Access to your domain’s DNS zone editor (through cPanel, your hosting provider’s dashboard, or wherever your DNS is managed)
– Admin access to your WordPress installation

Step 1: Log into the AWS Management Console

Head over to the {AWS Console} and sign in with your AWS account credentials. If your organization already uses AWS for hosting or other services, use the same account – keeping everything under one roof simplifies billing and access management down the road.

Step 2: Navigate to Amazon Simple Email Service

Once you are inside the console, use the search bar at the top to type “SES” and select Amazon Simple Email Service from the results.

This is the dashboard where you will manage all your sending identities, SMTP credentials, and deliverability settings for your Amazon SES WordPress setup.

Step 3: Add Your Domain Identity and Verify DNS Records (DKIM and DMARC)

Select “Identities” from the left side panel under Configuration and then select “Create Identity” as shown in the screenshot.

Selecting DOMAIN as your AWS SES:

1. If you select DOMAIN, please enter domain name without www or https e.g nopanichosting.com. Amazon SES also asks you to set up a custom MAIL FROM domain – typically a subdomain like mail.yourdomain.com (as shown in screenshot below). This gives SES a dedicated return path for bounce handling, which strengthens your sender reputation.
2. The DKIM should be set to EASY DKIM @2048 BIT (if your hosting supports otherwise @1024 BIT) and mark the checkboxes as shown in the screenshot:
   
3. TAG is optional but you can create in order to manage different services in your AWS Management Console.
4. Click on “CREATE IDENTITY”;
5. You will be redirected to the dashboard, scroll down and under AUTHENTICATION tab as shown. AWS will generate a set of DKIM records (typically three CNAME entries) that you need to add to your domain’s DNS zone editor. If your site is hosted on a cPanel-based host, you will find the zone editor under the Domains section. Other control panels – Plesk, Cloudflare DNS, or registrar-managed DNS – work the same way, just in a different interface.
   
6. Similarly, scroll down the page and add the MAIL FROM subdomain records (MX and TXT) into the DNS zone editor.
   

NOTE: If your MX record is already connected to another mailing provider (Google Workspace, Zoho, Outlook), additonally, you want to add Amazon SES, then instead of using mail.yourdomain.com, please use e.g aws.yourdomain.com.

Step 4: (SKIP if domain selected in previous step) Alternatively, Verify a Single Email Address

1. If you opt in to use a single email as your sender, please select EMAIL and enter your required email for authentication;
2. DKIM is not required (skip this step);
3. TAG is optional but you can create in order to manage different services in your AWS Management Console.
4. Click on “CREATE IDENTITY”;
5. You will receive an email from Amazon SES for verification, open and click on the link provided in the email to verify your email address;

This is the faster path, but domain-level verification is always preferred for production WordPress sites because it covers every address on that domain automatically.

Step 5: Add and Verify the DMARC Record

While you are in the zone editor, generate a DMARC record using a tool like {DMARCDKIM Generator} and add it as a TXT record.

• DMARC is the policy layer that tells receiving mail servers what to do when an email fails authentication – reject it, quarantine it, or let it through. A basic DMARC policy is a simple but significant step that many sites skip entirely, and it makes a real difference in deliverability.
• DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every outgoing email, allowing inbox providers to confirm the message genuinely came from your domain and was not tampered with in transit. Paste the records AWS gives you into DNS and wait for verification, which usually takes a few minutes to a few hours.

DKIM proves the email is really from you. DMARC tells inbox providers what to do if it is not. Together, they are the reason your messages land where they should.

Step 6: Remove Conflicting DNS Records for the MAIL FROM Subdomain

Before you move on, check your DNS for any leftover records tied to mail.yourdomain.com. If there is an existing A record or CNAME for that subdomain, delete it. Those conflicting records can block SES verification and cause confusing errors later. Clean DNS is happy DNS.

Step 7: Create SMTP Credentials in AWS

With your domain verified and authenticated, the next step in your Amazon SES WordPress setup is generating the credentials WordPress will use to connect. This creates an IAM user specifically for sending email through SES.
Inside the SES console, navigate to SMTP Settings and click “Create SMTP Credentials” as shown below:

Step 8: Name the SMTP User After the Client Website

AWS will ask you to name the IAM user. Use the client’s website name or project name – something immediately recognizable. This is not a technical requirement, but when you are managing multiple SES integrations across clients, clear naming saves you from confusion months down the road.

1. Enter username e.g (AbcXyz), TAG is optional and click CREATE CREDENTIALS.
2. Make sure to download the SMTP username and password .csv file.

Step 9: Add Permissions to the SMTP User

The SMTP user needs the right permissions to actually send email. Follow the steps:

1. Inside IAM, under PERMISSIONS, click on “Add Permissions” as shown:
   
2. Select “Attach Policies Directly” and inside the search bar select:
   AmazonSESFullAccess, AmazonSNSFullAccess, and AmazonSesSendingAccess.
   
   
3. Click on NEXT and Then ADD PERMISSIONS.

Without these three, the connection may authenticate but silently fail to send – which is exactly the kind of invisible problem that makes email infrastructure frustrating.

Step 10: Create the Access Key from IAM Username Dashboard

1. Click on “Create Access Key” under ACCESS KEY 2;
   
2. Under USE CASE, select “Other” and click NEXT;
3. Assign a TAG (optional) and click “Create Access Key”;

IMPORTANT: Copy and Save both the keys i.e. ACCESS + SECRET KEY, also download the .csv file.

Step 11: Install and Configure FluentSMTP with Your AWS (Access + Secret)

There are several WordPress SMTP plugins available, and we have tested most of them. {FluentSMTP} is the one we keep coming back to. It is free, actively maintained, lightweight, and has a clean interface for managing multiple email connections.

“Simplicity is the ultimate sophistication.” – Leonardo da Vinci. When it comes to WordPress email plugins, FluentSMTP earns that description honestly.

1. Inside FluentSMTP’s settings, select Amazon SES as your connection type;
2. Enter the sender email address and name – this should be the noreply@yourdomain.com (in case you selected DOMAIN as your identity in STEP3) or the email address (if you selected EMAIL ADDRESS as your identity in STEP 4), and it must match a verified identity (domain) in SES.
3. Copy and Paste in your Access Key and Secret Key that you created in STEP 10, select your SES region (region should match the location selected in your AWS SES account, in our case it is US-WEST N. California) and click save the connection. (Incase, there is connection error, try deleting and generating the ACCESS key in again in AWS SES);
   
4. If the connection is successful. FluentSMTP includes a built-in email test feature – use it immediately. Send a test email to a real inbox, ideally a Gmail or Outlook address since those are the strictest about authentication. Check that the message arrives in the inbox, not spam.
   
5. To further confirm that the test email came from AWS configured (mail from subdomain), open the email received in your inbox (Gmail, Zoho, Outlook etc.), and check the Message Header, or Show Original (the raw format of email). In our case, we use Zoho mail for No Panic Design, so it looks like this (see screenshot below):
   

Step 12: Test from Your Website and Verify Inbox Delivery

The final step in your Amazon SES WordPress setup is real-world testing.

1. Submit a contact form on your site, trigger a WooCommerce order notification, or fire whatever transactional email your site sends most often.
2. Confirm the message arrives in the inbox – not the spam folder – and that the sender name and address look correct.
3. Open the email headers if you want to verify that DKIM is passing and the MAIL FROM domain is showing correctly. If everything lands where it should, your setup is complete.

Server Errors After Amazon SES WordPress Setup

If FluentSMTP shows a server error when you try to send, the most common culprit is your hosting provider’s email routing configuration. In cPanel, navigate to Email Routing and make sure it is set to “Automatic” rather than “Local” or “Remote.” Some hosting environments override outbound mail settings by default, and this single toggle resolves the issue more often than you would expect.

On non-cPanel hosts, look for similar settings in your hosting dashboard or contact your provider’s support. You are looking for anything that controls outbound mail routing or SMTP relay permissions. The symptoms – a connection that authenticates but fails to send – are the same regardless of the hosting panel.

Emails Still Landing in Spam

If messages arrive but land in spam, work through this checklist:

• Verify that your DKIM records are valid and passing – use {MXToolbox} or Google’s email header analyzer
• Confirm that your DMARC record is published and has a policy of at least p=none (p=quarantine or p=reject is stronger but start with none if you are new to DMARC)
• Check that no conflicting DNS records exist for your MAIL FROM subdomain
• Make sure your sending domain is not on any public blacklists – MXToolbox has a blacklist checker for this

Deliverability is not a single setting. It is the cumulative result of authentication, reputation, content, and sending patterns all working together. The Amazon SES WordPress setup handles the infrastructure side. The rest is about maintaining good sending practices over time.

For marketing directors, the temptation is to treat email infrastructure as a “set it and forget it” technical detail. And honestly, once it is properly configured, it mostly is. But the difference between a site that sends unauthenticated email through a shared web server and one that sends through a verified, DKIM-signed, DMARC-protected SES integration is the difference between inbox and spam. Between a lead who gets your follow-up and one who never sees it.

Every form submission that vanishes, every order confirmation that hits junk, every password reset that forces a support ticket – those are friction points that erode trust with your audience. A proper Amazon SES WordPress setup eliminates an entire category of problems that most site owners do not even realize they have until something important goes missing.

You do not notice good email deliverability. You only notice when it fails. The goal is to make it invisible.

If this feels like more infrastructure than you want to manage, that is completely reasonable. This is exactly the kind of behind-the-scenes work that No Panic Design handles for our clients as part of {Site Management}. We set it up, we test it, and we monitor it so you never have to think about whether your emails are actually arriving.

Website: https://www.nopanicdesign.com
LinkedIn: https://www.linkedin.com/company/no-panic-design
Instagram: https://www.instagram.com/nopanicdesign
Facebook: https://www.facebook.com/nopanicdesign