Preface

My previous article (Home Data Center Series: Using cloudflare+resend+gmail to build a free personal-grade corporate mailbox) introduced using resend to build your own personal corporate mailbox for free. While writing the article, I noticed that the emails received by the recipient mailbox ultimately came from Amazon SES. In other words, resend is just a middleman, and ultimately still uses Amazon SES to send emails. So, can we skip resend and use SES directly? What is the difference between the email content sent directly using SES and using resend? What advantages does it have compared to sending emails via resend?

Considering that I might also come into contact with various Amazon services in the future (to study how to get them for free), and I am not very familiar with Amazon yet, I will take this opportunity to get familiar with it through SES first.

Note: The prerequisite is that you need to register an Amazon account (root user) first, because a single Amazon user will involve many accounts with different permissions, and the root user is the one that centrally manages these accounts with different permissions.

Initializing Amazon SES

After logging into the console using the root user, search for "ses" directly in the search box on the top left, and then directly select the "Amazon Simple Email Service" entry in the red box to enter:

First, provide an email address. This email is only used to receive the verification link to confirm whether this email belongs to you, so feel free to provide any of your own email addresses. I directly provided an email with my own domain suffix:

Then add the sending domain, just add your own domain suffix here:

Add "MAIL FROM domain", you don't need to worry about this here, it can also be set after initialization is complete:

After confirming the information filled in above, click "Get started" in the red box:

Required to use the email address filled in earlier for link verification:

After verification is successful, return to the SES console to continue configuration:

Complete sending test emails and verifying the sending domain

Then you need to pass the remaining 2 verifications:

Send test email:

Optional scenarios are as follows:

Verify sending domain:

In "Amazon SES" - "Configuration" - "Identities", click "tangwudi.com" to enter:

Add required records in the DNS provider console

Add DKIM information in the DNS provider records according to the prompts below:

Note 1: For the CNAME name, you only need to enter the part in the red box
Note 2: If the DNS provider is Cloudflare, be careful not to enable the "orange cloud" (Proxied) for CNAME, use "DNS only".

Add MX and SPF records in the DNS provider console according to the prompts below (specify MX record priority as 10):

Add DMARC records in the DNS provider console according to the prompts below:

Fill in custom MAIL FROM domain (optional)

---

Note: When sending an email, it has two addresses that indicate its origin: a From address displayed to the email recipient, and a MAIL FROM address indicating the source of the email. The MAIL FROM address is sometimes called the envelope sender, envelope from, bounce address, or Return Path address. Email servers use the MAIL FROM address to return bounced emails and other error notifications. Usually, recipients can only view the MAIL FROM address when viewing the source code of the email. For example, the following is the From address:

The following is the sender address in the email source code when the custom MAIL FROM domain is not set:

The following is the sender address in the email source code when the custom MAIL FROM domain is set:

Why set up a custom MAIL FROM domain?

By using a custom MAIL FROM domain, you can flexibly use SPF and/or DKIM to achieve Domain-based Message Authentication, Reporting, and Conformance (DMARC) verification. DMARC enables the sender's domain to indicate that emails sent from that domain are protected by one or more authentication systems.

If you do not have the above-related requirements, you do not necessarily have to customize the MAIL FROM domain; using the default value is also fine and will not affect normal use.

---

Upon final success, it will display "Verified":

All 3 verifications have been completed:

These options can further improve email deliverability. The first one can be added, but it is a bit troublesome. The second and third options are paid items... so I didn't bother with these 3 options:

Obtain SMTP-related information

There is no SMTP account by default, it needs to be created manually. Select "SMTP Settings" - "Create SMTP Credentials":

Just create it directly:

Save the SMTP username and password:

Returning to the SMTP settings, you can see the SMTP server and port:

Comparison of sending emails between Amazon SES and resend

After obtaining the SMTP information, you can perform email sending tests. Since it is currently in the "sandbox" state, you can only send emails to verified email addresses. If you want to send emails to a QQ mailbox, you also need to add the QQ mailbox to the identities, referring to the previous steps to add it:

Then, still following the testing method in the previous article (Home Data Center Series: Using cloudflare+resend+gmail to build a free personal-grade corporate mailbox), use Gmail as the client to send test emails to the QQ mailbox using the SMTP information provided by Amazon SES and the SMTP information provided by resend respectively. The results are shown below:
Using Amazon SES and not using custom MAIL FROM

Using Amazon SES and using custom MAIL FROM



Using resend:

After the above comparison, whether using resend or directly using Amazon SES to send emails to domestic mailboxes, a "sent on behalf of" prompt will appear. Carefully comparing the source code of emails with and without "sent on behalf of", you will find that the source code of the "sent on behalf of" email just has an extra "sender" line. Therefore, the "sender" line probably only appears when the From email suffix and the MAIL FROM email suffix are inconsistent (the description in the "sent on behalf of" information prompted by QQ Mail is: the real sending address is inconsistent with the claimed sender's address). When "sent on behalf of" is not used, for example, directly sending to domestic mailboxes using a Gmail email address, there is no "sender" line (because the real sending address is consistent with the claimed one).

Domestic mailboxes probably query the sender parameter. As long as it exists and is an overseas mailbox (regardless of whether a custom MAIL FROM is used), it will warn about "sent on behalf of". The only uncertainty is whether domestic corporate mailboxes have an interoperability agreement regarding sending on behalf of each other, such as not warning if the sender is a domestic mailbox. I don't have the conditions to test this, but you can test it yourself if you have the conditions.

Therefore, we can conclude that using Resend and directly using Amazon SES to send emails to domestic mailboxes are exactly the same, with no difference.

So does directly using Amazon SES have any advantages compared to Resend? Actually, yes, for example:

Resend offers 100 emails per day, while Amazon SES offers double that amount~~~ However, for most people, Resend is still recommended. It's simple, and 100 emails are more than enough for normal users.

What if you insist on using Amazon SES? Then you have to submit and pass the "Request production access" to be removed from the sandbox, but~~ it's not that simple.

Request production access

Let's challenge the request for production access:

It requires providing information, with only two options: Marketing and Transactional. I chose Marketing, provided the website URL, wrote a random sentence in the "Use case description", and then submitted the request:

I thought that was it, but the result:

Oh my, are the requirements that high? As an honest person, I told the truth:

The general idea was that it's only used to reply to visitors' emails, and in the short term, I estimate sending fewer than 20 emails a day (actually, probably none, but I was too embarrassed to say so), and then it was rejected~:

Well, it seems I'm not qualified to use Amazon SES, so I'd better stick to using my Resend honestly... However, this also indirectly shows that if a user can pass the "Request production access" step and use Amazon SES to send emails on their behalf, there is a high probability that everything is fine (including using Resend). That's why foreign mailboxes can accept emails sent on behalf of Amazon SES without any abnormal warnings. And even for domestic mailboxes, at most it just warns about "sent on behalf of" (and the red warning in QQ Mail), but getting into the inbox is still not a problem.

Afterword

It is probably because Amazon SES has a barrier to entry that Resend exists. Moreover, unless it is a business already operating on Amazon or an independent website owner, for an ordinary person to register an Amazon account just to use Amazon SES to send emails, that would be too much of a hassle (unless they are not an ordinary person).

In short, now I can finally use Resend with peace of mind~~.