How to Create a Custom Email Service with Amazon SES, Amazon WorkMail, and Route 53

In today’s digital age, having a professional email service linked to your domain is crucial for building brand credibility and effective communication. Amazon Web Services (AWS) offers a robust, scalable, and affordable email solution that combines Amazon Simple Email Service (SES) for sending emails and Amazon WorkMail for email client management. In this post, I’ll guide you through creating a custom email service using SES, setting up WorkMail as your client, and configuring your domain in Route 53.

Prerequisites:

Before diving in, make sure you have the following:

- An AWS account with permissions to create and manage SES, WorkMail, and Route 53 resources.

- A registered domain name hosted in Route 53 (or ready to transfer to Route 53).

- Basic knowledge of DNS records (DKIM, MX, SPF) and email protocols.

Walkthrough

Step 1: Setting Up the Domain in Amazon Route 53

Your domain acts as the backbone of your email service. First, ensure your domain is registered in Amazon Route 53. If you don’t have a domain registered, you can easily register one via Route 53.

1. Log into your AWS Console and navigate to Route 53.
2. Click Domains, then select Register Domain or Transfer Domain if you are moving an existing domain to Route 53.
3. Once the domain is set up, go to Hosted Zones and click Create Hosted Zone for your domain.
4. AWS will automatically create a set of NS (Name Server) and SOA (Start of Authority) records for DNS management.

Configuring DNS Records:

You’ll need to configure DNS records for your domain to enable email functionality. 

- MX Record: This ensures that emails are routed to the correct mail server.

- SPF Record: Prevents unauthorized emails from being sent on behalf of your domain.

- DKIM Record: Enables email validation to prevent email spoofing.

          For example:
          Type: MX
          Value: 10 inbound-smtp.region.amazonaws.com
          Type: TXT

          Value: "v=spf1 include:amazonses.com ~all"

Step 2: Configure Amazon SES for Sending Emails

Amazon SES is a scalable email-sending platform. We’ll use SES to handle sending emails for your domain.

1. Navigate to Amazon SES in the AWS Management Console.

2. Select Identities under the Configuration section.

3. Click Create Identity and enter your domain name (e.g., `veryprodomain.com`).

4. SES will provide DNS records (TXT, CNAME) for verifying domain ownership and enabling DKIM.

5. Add these records to your Route 53 hosted zone. You can select push to DNS records so you don't have to do it manually.

Enabling Email Sending:

Once your domain is verified, you can enable sending.

- Under Get Set Up, ensure production mode is enabled and remove any sending limits.

- Add any email addresses that you want to send from.

SMTP Client

You can use an SMTP-enabled programming language, email server, or application to connect to the Amazon SES SMTP interface. 

When you select create SMTP credentials, you will create a SMTP user in IAM and you will be able to modify policies. Make sure you copy these credentials before you save it in case you need to see it and use it in further services, if you miss these, you will have to create a new user.

Step 3: Set Up Amazon WorkMail as Your Email Client

Now that your domain is verified in SES, it’s time to configure Amazon WorkMail as the email client. WorkMail offers a professional interface, complete with calendar and contact management, and integrates seamlessly with other AWS services.

1. Navigate to Amazon WorkMail in the AWS Console.
2. Create an organization by selecting your preferred region and name.
3. Once the organization is set up, click Add Domain and enter your domain name.

4. You can review the Workmail authorization policy attached in Amazon SES under Configuration - Identities, this is created automatically but if it is missing you will have to modify it manually. You can also add new policies depending on the type of services you need to authorize.

5. Verify that you if you need to use and setup a SMTP Gateway, for this you can go to Organization Settings and then create the gateway.

Adding Users:

1. Under the Users tab, click Create User to generate new email addresses for your domain.
2. Once a user is created, they can access the WorkMail client through https://mail.yourdomain.com.

Step 4: Test and Finalize Your Setup

Once everything is configured, it’s time to test your email service to ensure everything works as expected.

1. Send a Test Email: Use SES to send a test email from your verified domain to ensure email delivery is working. You can do this by navigating to the SES Console, choosing Email Sending, and sending a test email to your newly created email addresses.

2. Check DNS Health: Use AWS’s Route 53 Health Check feature to monitor your domain's email-related DNS records to ensure they are functioning correctly.

3. Monitor Email Deliverability: Amazon SES provides email metrics under the Dashboard, such as Bounce Rates, Complaint Rates, and Delivery Status. Monitor these regularly to maintain a good email-sending reputation.

4. Go directly to your Amazon Workmail and send an email to check everything is working ok.

Troubleshooting

There are some extra testing you can do in case something is odd. To save you a rabbit hole Microsoft Services are a bit tricky and not consistent all the time specially when delivering to organizations with multiple security layers, in this case, emails might or might not land in your junk mail. Still here are some extra tools and testing you can do:

• Perform an external checkup - https://www.mail-tester.com/
• Test deliverability - https://mxtoolbox.com/deliverability/
• Check DNS records externally - https://mxtoolbox.com/SuperTool.aspx
• Review your Route53 DNS records
• Send an email to a self-owned Microsoft address /domain and manually evaluate your email headers in security.microsoft.com in Email & Collaboration - Explorer Section.

Extra bonus: Sometimes you just need to mature your domain / email to be in the safe with "spamability" and for that is either waiting or use a service such as https://www.warmy.io/product/warm-up-email

Conclusion

By combining Amazon SES, Route 53, and WorkMail, you can create a powerful and secure custom email solution for your domain. This setup ensures reliable email delivery, easy management, and professional communication. With the scalability of AWS, this solution can grow with your business, supporting everything from marketing campaigns to day-to-day operational emails.

Setting this up might seem complex at first, but by following these steps and AWS's robust management tools, you’ll have your email service up and running smoothly.

Resources

- [Amazon SES Documentation]

- [Amazon WorkMail Getting Started]

- [Route 53 DNS Management]

I hope you enjoyed this post and you find it useful for your hacking. See you in the next post! ♥