Can Mail Manager also handle outbound email traffic?

0

I started using the SES Mail Manager, to see if it could replace our current remote e-mail gateway.

I checked a test domain, created a first ingress endpoint, configured the DNS as required. Incoming e-mails are delivered to an SMTP relay, and received correctly by the destination e-mail server.

So far, so good.

What is not clear to me, is whether Mail Manager can be used also as a sending system.

Reading the blog post: https://aws.amazon.com/blogs/messaging-and-targeting/mail-manager-amazon-ses-introduces-new-email-routing-and-archiving-features/

"Amazon Simple Email Service (SES) is a cloud-based email sending service provided by Amazon Web Services (AWS), handling both inbound AND OUTBOUND email traffic for your applications. It allows users TO SEND and receive email using SES's reliable and cost-effective infrastructure without having to provision email servers themselves."

In contrast, the documentation at: https://docs.aws.amazon.com/ses/latest/dg/eb.html

only talks about incoming email, and nowhere refers to outgoing email, i.e. how to configure and use Mail Manager to send mail.

Can you help me understand whether Mail Manager can also be used to centralise the sending of e-mails, and give me guidance on how to do this, or the necessary documentation?

Thank you in advance, Gabriele

已提问 1 个月前208 查看次数
4 回答
0

Hi,

unfortunately I still haven't managed to configure Mail Manager correctly for sending.

  1. I have verified in SES a test identity, a second level domain.

  2. I created a traffic policy, with "Default action: Allow" and nothing else

  3. in IAM I created a policy called "MailManager_send-to-internet", authorising as IPs those of the e-mail servers that are to use MailManager as smart hosts.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ses:SendEmail",
                "ses:SendRawEmail"
            ],
            "Resource": "arn:aws:ses:*:{MyAWSAccountId}:identity/*",
            "Condition": {
                "IpAddress": {
                    "aws:SourceIp": [
                    	"123.123.123.123/32",
                    	"123.123.123.124/32",
                    	"123.123.123.125/32"
                    ]
                }
            }
        }
    ]
}
  1. in IAM I created a group called 'MailManager-users' and attached the newly created policy

  2. in IAM I created a new user called "MailManager-user01" and placed it in the "MailManager-users" group

  3. in Mail Manager I created an SMTP Relay

  4. in Mail Manager I created a set of rules:

    rule1) SMTPRelay action -> Relay resource name: {the name of the SMTP relay created}

    rule2) Send to internet -> IAM role: AWSServiceRoleForAmazonSES

I had already created an open ingress endpoint, but this procedure did not work. Since you told me about creating an authenticated ingress endpoint, I wanted to try it out by deactivating the open one and creating an authenticated one.

Unfortunately, it doesn't work that way either. On my e-mail server, I use:

- relay SMTP server (smart host): {ARecord of the ingress endpoint}
- port: 587 (or even 465)

but it fails to authenticate because the ingress endpoint does not respond and goes into timeout.

Where am I going wrong?

已回答 1 个月前
  • Hi,

    Can you try port 25 for connecting to the ingress point?

    Robin

0

Hi,

Yes, Mail-manager can handle outbound traffic as well. Its not really clear from the documentation but there is a "Send to internet" action that you can add to a rule set which allows you to send mail out email via SES. You will need to create a IAM role that can call SES to send mail and verify the identity to send mail to. Or have your account removed from Sandbox status.

Kind regards. Robin

AWS
专家
已回答 1 个月前
0

Thank you for your response. I guess the documentation on this is not that comprehensive yet, as it is a new feature. However, I would need some clarification, I am not an expert on AWS, I have only recently gotten into it.

If it really can be used for sending as well, I would like to configure my current email systems to use Mail Manager as a "smart host," but to do this I would like to know what SMTP parameters to use, and if I need to do anything in particular on the AWS side to make Mail Manager work this way.

Thank you once again for your help. Gabriele

已回答 1 个月前
0

Hi,

This would be a very basic set-up where you can use Mail manager as a mail sending smart host. If you have not already done so, you will first need to verify your domain in the SES console and request production access. Without your domain verified you will not be able to send mail. Without production access your sending will be limited to recipients that are in the verified identities.

Once the domain set-up is done, the mail manager stack starts of with creating a Traffic policy and Rule set before you can create the Ingress point. You can create both of these resources to fit your needs. The traffic policy can allow all traffic as it will be an authenticated ingress point but feel free to set restrictions to secure the ingress point more strictly (For example, only accept traffic from your systems IP). For the Rule set you can create a empty rule set as I will describe what rules to you need later.

The Traffic policy and Rule set are required to create an Authenticated ingress point so select the one you just created during the creation (More details are in the docs). With the authenticated ingress point you can connect you system to that to route mail from your system into Mail manager.

For actual sending mail you will have to create a Rule in the Rule set with the "Send to internet" action. For this you will need a basic policy with permissions to allow send mail for the desired identity. You can use the policy below, add your account ID and if you want you can restrict it to a single identity (replace the * after identity/ with the identity).

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "ses:SendEmail",
                "ses:SendRawEmail"
            ],
            "Resource": "arn:aws:ses:*:{AWSAcountId}:identity/*"
        }
    ]
}

With the rule created you should be able route mail through Mail manager and out to the internet. The rules allow for many more actions to full manage your mail flow that fits your needs.

Kind regards. Robin

AWS
专家
已回答 1 个月前

您未登录。 登录 发布回答。

一个好的回答可以清楚地解答问题和提供建设性反馈,并能促进提问者的职业发展。

回答问题的准则