Running Cold Email on Amazon SES: What You Get and What You Have to Build

Amazon SES looks irresistible on paper: fractions of a cent per email, AWS-grade uptime, and no per-seat pricing. But SES is a raw sending pipe, not an outreach system. Before it can carry a B2B cold campaign responsibly, you have to build warmup, bounce handling, suppression, reply capture and reputation monitoring yourself. This guide lays out what that actually involves — and where the DIY route stops making sense.

What SES actually is — and is not

Amazon SES is a bulk SMTP and API sending service built primarily for transactional mail: receipts, notifications, password resets. It gives you high-throughput sending, authentication support (SPF, DKIM, custom MAIL FROM), event notifications through SNS, and per-message pricing that undercuts almost everything on the market.

What it does not give you: contact management, sequences, personalization templates beyond basic substitution, reply detection, unsubscribe handling, per-mailbox volume pacing, warmup automation, or any concept of a campaign. SES does not know or care whether message five thousand is a shipping notice or the fifth follow-up to a prospect who asked you to stop. Every one of those responsibilities lands on you.

That distinction matters more for cold outreach than for newsletters. Address-based B2B outreach lives or dies on reply handling and list discipline — precisely the layers SES leaves empty.

The reputation model: shared IPs, hard thresholds

By default SES sends from shared IP pools. Your deliverability is partly hostage to other tenants, and AWS protects the pool aggressively. Two metrics govern your life: bounce rate and complaint rate. As working guardrails, treat roughly 5% bounces and 0.1% complaints as the danger zone — sustained rates near those levels put your account under review, and reviews can end in a sending pause with little warning.

For transactional senders those thresholds are trivial to stay under. For cold outreach they are tight. A B2B contact list with normal decay can bounce 10–20% if you skip verification — enough to jeopardize the account on the very first large send. One angry recipient hitting «spam» per thousand messages puts you at the complaint threshold. In other words: SES's guardrails assume permission-based mail, and cold campaigns only fit inside them with rigorous list hygiene.

Dedicated IPs are available for a monthly fee and isolate you from pool neighbors, but they cut both ways: now the reputation is entirely yours to build, which means a real warmup plan and enough steady volume to keep the IP's reputation alive. A dedicated IP trickling thirty cold emails a day never builds meaningful history.

What you have to build yourself

Assume you proceed. Here is the minimum construction project between «SES account approved» and «responsible cold campaign running». None of it is optional.

Bounce and complaint processing is the most critical piece. SES publishes delivery events via SNS; you must consume those webhooks, classify bounces (hard versus soft), and write hard bounces and all complaints to a suppression store that every future send checks. SES has an account-level suppression list, but managing per-campaign and per-tenant suppression logic is on you. Miss this and your bounce rate compounds with every send until AWS shuts you off.

Reply handling is the piece DIY builders most often forget. SES is send-only in spirit — receiving requires configuring SES inbound (with its own rule sets and S3/Lambda plumbing) or pointing an inbox elsewhere and syncing via IMAP. Cold outreach without reliable reply capture is pointless: replies are the product. You also need out-of-office detection, sequence-stop-on-reply logic, and routing of positive replies to whoever handles them.

Then the long tail: warmup scheduling with gradual daily volume growth, per-domain and per-mailbox send pacing with randomized intervals, unsubscribe link handling including one-click List-Unsubscribe headers (which Gmail and Yahoo now expect from bulk senders), template rendering with real personalization, and monitoring dashboards for bounce, complaint and reply rates per campaign. Realistically this is several weeks of engineering to build and a permanent maintenance load to run.

• SNS webhook consumers for bounce, complaint and delivery events
• Suppression store checked before every single send
• Inbound mail path (SES receiving or IMAP sync) plus reply classification
• Warmup scheduler and per-mailbox daily caps with jittered send timing
• One-click unsubscribe headers and same-day opt-out processing
• Reputation dashboard: bounces, complaints, replies per campaign and per domain

The compliance and policy angle

AWS's acceptable use policy expects senders to mail recipients who have a reasonable expectation of hearing from them. Lawful B2B outreach can meet that bar — a relevant, targeted message to a business decision-maker, with a working opt-out and lawful basis under GDPR (legitimate interest, properly assessed) or CAN-SPAM's rules — but bulk spraying a purchased list does not, and AWS enforcement is quick and unsentimental.

This is worth internalizing: the same discipline that keeps you compliant with GDPR and CAN-SPAM — tight targeting, verified data, honest sender identity, instant opt-out handling — is also what keeps your SES account alive. There is no version of cutting corners on compliance that works economically on SES, because the account itself is the collateral.

Where DIY on SES makes sense — and where it does not

The honest cost comparison is not «SES at $0.10 per thousand versus a platform subscription». It is SES plus weeks of engineering plus ongoing maintenance plus the risk of losing the account mid-campaign, versus a system where those layers already exist. For an engineering-heavy team sending high volumes of semi-transactional mail with an outreach component, building on SES can pencil out. For a sales team that needs to run targeted campaigns this quarter, it almost never does.

There is also a structural mismatch: SES is optimized for one sender identity pushing volume, while serious B2B cold outreach spreads modest volume across many warmed mailboxes and domains to keep any single identity's footprint small and human-scaled. Orchestrating dozens of mailboxes with individual caps, warmup states and reputations is exactly the kind of machinery outreach platforms exist to provide.

The hybrid answer is often the right one: use commodity infrastructure where it is genuinely commodity, and put a purpose-built orchestration layer on top. That is how we approach it at LDM — the sending pipe is replaceable, but the layers that decide who gets which message, at what pace, from which mailbox, and what happens when they reply are the actual product. If you already run SES, the question is not whether to abandon it, but whether you want to keep hand-building the outreach brain around it.

Decision checklist before you commit

Run through this list before betting a quarter's pipeline on a raw SES build. If you answer «no» to more than a couple of items, the DIY route will cost more than it saves.

• Do you have engineering time not just to build bounce/complaint/suppression plumbing, but to own it permanently?
• Is every list you plan to send verified to keep hard bounces safely under the danger threshold?
• Do you have a working inbound path so no reply is ever missed?
• Can you enforce per-mailbox daily caps and warmup ramps automatically?
• Do you have a plan for the day AWS pauses the account mid-campaign?
• Have you documented your lawful basis (legitimate interest assessment for GDPR, CAN-SPAM mechanics for the US) for the outreach itself?

FAQ