Use AWS SES with GetFluxly

Connect Amazon SES to GetFluxly and run behavior-triggered lifecycle email through the cheapest production-grade send path most teams already have access to. GetFluxly captures product events, builds unified customer profiles, fires automations on the rules you define, and hands the rendered message to SES for the actual delivery. Your sender reputation, IP warmth, and domain authentication stay in AWS where they already live.

When to use AWS SES

Reach for SES when sending costs matter and you already operate inside AWS. SES bills around $0.10 per 1,000 emails with no monthly minimum, which is roughly an order of magnitude cheaper than the typical hosted ESP at SaaS scale. The trade-off is that SES gives you raw send-and-receive primitives, so you bring the templating, deliverability tooling, and lifecycle logic. That's exactly the layer GetFluxly handles, so the combination lands you with a low-cost, behavior-triggered email stack without the hosted ESP markup.

SES is also the right pick when you need region-pinned sending for data residency (GetFluxly will dispatch into whichever SES region holds the verified identity), or when you want a dedicated IP and a warm-up plan you control end-to-end.

Requirements before connecting

Before you start the connection, make sure you have an AWS account with SES enabled in your chosen region, a domain you can publish DNS records on, and access to the IAM console so you can create a dedicated sending user. If your account is still in the SES sandbox, plan to request production access in parallel. The approval usually lands within 24 hours and you can keep working against verified recipients in the meantime.

On the GetFluxly side you need a project, a workspace API key (gf_live_…), and access to Settings → Email providers.

Verify your sending domain

In the SES console, open Verified identities → Create identity → Domain and enter the apex domain you want to send from (for example yourdomain.com). SES will generate three DKIM CNAME records. Copy them and add them at your DNS provider exactly as SES displays them. Status flips to Verified once the records propagate, usually within a few minutes.

Verifying the apex domain covers every from address that lives under it (hello@, billing@,noreply@ and so on) so you don't need to verify individual mailboxes.

Add SPF, DKIM, and DMARC

These records live on your domain's DNS, not on GetFluxly, and they tell receiving mailboxes that AWS SES is allowed to send on your behalf. All three are publishable in seconds; getting them right is the single biggest deliverability win you can make.

SPF

Add a TXT record at the apex of the sending domain that includes Amazon SES. If you already have an SPF record, merge the include: rather than publishing two SPF records (multiple SPF records on the same name fail validation).

Type:   TXT
Host:   yourdomain.com
Value:  v=spf1 include:amazonses.com -all

DKIM

SES auto-generated three CNAME records when you verified the domain in the previous step. They look like this, host and value strings are unique per domain:

Type:   CNAME
Host:   <selector1>._domainkey.yourdomain.com
Value:  <selector1>.dkim.amazonses.com

Type:   CNAME
Host:   <selector2>._domainkey.yourdomain.com
Value:  <selector2>.dkim.amazonses.com

Type:   CNAME
Host:   <selector3>._domainkey.yourdomain.com
Value:  <selector3>.dkim.amazonses.com

DMARC

DMARC tells receivers what to do if SPF and DKIM both fail. Start with p=none while you confirm legitimate mail passes, then ratchet up to quarantine and eventually reject.

Type:   TXT
Host:   _dmarc.yourdomain.com
Value:  v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; fo=1

Create SES credentials

GetFluxly speaks two SES dialects: the SES API (signed with an IAM access key pair) and SMTP (using SES SMTP credentials). Pick the path that matches your sending volume and network policy.

Option A IAM access key (recommended)

Create a dedicated IAM user (not your root credentials) so you can rotate or revoke without breaking the rest of your infrastructure. Attach the minimal policy below, then mint an access key under the user. Copy the access key id and secret access key AWS only shows the secret once.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ses:SendEmail",
        "ses:SendRawEmail"
      ],
      "Resource": "*"
    }
  ]
}

Option B SES SMTP credentials

In SES choose SMTP settings → Create SMTP credentials. AWS provisions a wrapper IAM user and hands back an SMTP username and password. Use these with the GetFluxly Custom SMTP connector and the region's SMTP endpoint, e.g. email-smtp.us-east-1.amazonaws.com on port 587 with STARTTLS.

Or provision SES via CloudFormation

If your team manages AWS in code, ship the SES + IAM setup as a CloudFormation stack so the sending identity is reviewable, version controlled, and reproducible across environments. Drop this template into your IaC repo and deploy it once per environment.

AWSTemplateFormatVersion: "2010-09-09"
Description: GetFluxly + Amazon SES lifecycle sending stack

Parameters:
  SendingDomain:
    Type: String
    Description: Apex domain to send from (e.g. yourdomain.com)

Resources:
  SesIdentity:
    Type: AWS::SES::EmailIdentity
    Properties:
      EmailIdentity: !Ref SendingDomain
      DkimAttributes:
        SigningEnabled: true

  GetFluxlySender:
    Type: AWS::IAM::User
    Properties:
      UserName: getfluxly-ses-sender

  GetFluxlySenderPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: getfluxly-ses-send
      Users: [!Ref GetFluxlySender]
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action:
              - ses:SendEmail
              - ses:SendRawEmail
            Resource: "*"

  GetFluxlyAccessKey:
    Type: AWS::IAM::AccessKey
    Properties:
      UserName: !Ref GetFluxlySender

Outputs:
  AccessKeyId:
    Value: !Ref GetFluxlyAccessKey
    Description: Paste this into GetFluxly → Email providers → Amazon SES.
  SecretAccessKey:
    Value: !GetAtt GetFluxlyAccessKey.SecretAccessKey
    Description: Paste this into GetFluxly. Treat it like a password.

After the stack creates, fetch the outputs (aws cloudformation describe-stacks) and paste them into the GetFluxly provider form. The DKIM CNAMEs come from the SES console under the new identity, add those to your DNS exactly as shown above.

Connect AWS SES in GetFluxly

Open your GetFluxly project, go to Settings → Email providers, click Add provider, and choose Amazon SES. Fill in the fields below and save GetFluxly verifies the credentials with a real SendEmail preflight before it persists the record.

Or call the API directly:

curl -X POST https://api.getfluxly.com/v1/projects/PROJECT_ID/email-providers \
  -H "Authorization: Bearer gf_live_REPLACE_ME" \
  -H "Content-Type: application/json" \
  -d '{
    "provider": "aws_ses",
    "display_name": "SES Production",
    "region": "us-east-1",
    "from_email": "hello@yourdomain.com",
    "from_name": "Acme",
    "access_key_id": "AKIA...",
    "secret_access_key": "..."
  }'

Handle bounces and complaints

SES emits feedback events through SNS. Wire them to GetFluxly so a hard bounce or complaint immediately suppresses the recipient from future sends, that single hop is the difference between a healthy sending reputation and a quiet drift into the spam folder.

1. Create an SNS topic in the same region as your SES identity, e.g. getfluxly-ses-feedback.
2. In SES, open Verified identities → your domain → Notifications and assign the SNS topic to Bounce and Complaint feedback.
3. In GetFluxly, copy the project webhook URL from Settings → Webhooks → AWS SES, it looks like https://api.getfluxly.com/v1/webhooks/aws-ses/<project_id>.
4. Subscribe that URL to the SNS topic as an HTTPS subscription. SES sends a confirmation ping; GetFluxly auto-confirms it on first receipt.

From this point on, every bounce or complaint updates the suppression list and tags the contact in the unified profile so your segments naturally exclude them.

Test your first lifecycle email

Hit the verify endpoint to dispatch a single message through SES. If it lands, your wiring is good and you can point an automation at this provider record.

curl -X POST https://api.getfluxly.com/v1/email-providers/PROVIDER_ID/test \
  -H "Authorization: Bearer gf_live_REPLACE_ME" \
  -H "Content-Type: application/json" \
  -d '{ "to": "you@yourdomain.com" }'

For an end-to-end behavior-triggered test, set up a one-step automation: when user fires signed_up → send the welcome email through SES, then trigger the event from your staging app. The send shows up in GetFluxly's send log within a couple of seconds.

Common errors

MessageRejected: Email address is not verified the address in from_email is not under a verified identity in the configured region. Re-check the region pin and confirm the identity status reads Verified.

InvalidClientTokenId / SignatureDoesNotMatch the access key pair is wrong or has been deactivated. Mint a fresh access key for the IAM user and update the GetFluxly record.

Sandbox cap (200/day, verified recipients only). New SES accounts are sandboxed. Request production access in the SES console to lift the cap.

Throttling: Maximum sending rate exceeded. Your account is over the per-second send quota. GetFluxly retries with exponential backoff, but if you're consistently hitting this, request a sending quota increase in the SES console.

Mail going to spam despite SPF and DKIM passing. Almost always a missing or misconfigured DMARC record, or a sending domain with no warm-up history. Confirm DMARC is published on _dmarc.yourdomain.com and ramp volume gradually (~50→500→5,000/day) over the first two weeks.

FAQ