Configure Amazon SES SMTP for NineData

Use Amazon Simple Email Service (Amazon SES) as your NineData organization's SMTP service for alert notifications and DevOps status emails. This guide covers SES preparation, authentication and sender fields in NineData, and delivery checks.

Before you begin

• Open the target NineData organization with the Administrator role. This guide applies to organization email settings in the SaaS console.
• Have an AWS account and an administrator with the IAM and SES permissions needed to manage sending identities and SMTP credentials.
• Prepare an email address or domain that you control, and an accessible test mailbox for delivery checks.
• Ensure that the network hosting the NineData email service can reach the selected SES SMTP endpoint and port. Access to the AWS console from your browser does not establish SMTP connectivity from NineData.

caution

Changing the organization's email service affects subsequent alerts and DevOps notifications. Follow your organization's change approval process and retain the previous settings and usable credentials securely for recovery. Keep AWS keys, SMTP passwords, and credential files out of documentation, screenshots, tickets, and source control.

Prepare Amazon SES

1. Select a sending Region and endpoint

Open the Amazon SES console, select the sending Region, and record its SMTP endpoint from the SMTP settings. The endpoint, SMTP credentials, and identity verification must correspond to the same Region.

SES requires encrypted connections. Common choices are:

SES connection method	Common port	Behavior
STARTTLS	587	Upgrades the SMTP connection to TLS.
TLS Wrapper (SMTPS)	465	Uses TLS from the start of the connection.

Use the endpoint for your selected Region. For connection methods and other available ports, see Connecting to an SES SMTP endpoint.

2. Verify the sending identity

Create and verify an email or domain identity in the selected Region. For an email identity, follow the verification email. For a domain identity, configure the DNS records supplied by SES. Wait for verification to complete before sending. See Creating and verifying SES identities.

Check the sandbox status in that Region:

• In the sandbox: The test recipient address or its domain must also be verified. The AWS mailbox simulator is an exception.
• With production access: Recipients do not need individual verification, but the sending identity must still be verified.

Before sending organization notifications to unverified recipients, follow the AWS production access procedure. Production access is specific to each Region.

3. Obtain SMTP credentials

Create dedicated SMTP credentials in the SES console, or derive them from an existing IAM user's long-term access keys. Follow Obtaining SES SMTP credentials.

Method	SMTP username	SMTP password
Create credentials in SES	The generated SMTP username.	The generated SMTP password.
Derive from IAM access keys	The user's Access Key ID.	The password derived from the Secret Access Key and sending Region using the AWS algorithm.

An SMTP password differs from a Secret Access Key and an AWS console password. Temporary security credentials cannot generate SES SMTP credentials. Perform derivation in a controlled environment and store the result securely.

For an existing IAM user, have your AWS administrator verify ses:SendRawEmail permission. This AWS example policy can be assigned to a dedicated sending user through a user group:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ses:SendRawEmail",
      "Resource": "*"
    }
  ]
}

Resource: "*" does not restrict the policy to a specific resource. Have the AWS administrator review the authorized scope. Do not grant administrator access merely to enable SMTP sending.

Configure NineData

1. Sign in to the NineData Console and open the target organization.

2. Go to Account > Organization.

3. Find Message Notification Configuration, ensure its switch is enabled, and click Modify Config in that section.

4. Complete the fields in Mail configuration Service.

   Field	SES value
   SMTP Server Address	SMTP endpoint hostname for the selected Region, without https://.
   SMTP Port	Port for the connection method, such as 587 or 465.
   SMTP encryption	Select TLS for STARTTLS or SSL for TLS Wrapper. Check the port separately. Do not select None.
   Sender Account	SES SMTP username, or the Access Key ID when deriving credentials from IAM keys. This field authenticates the connection; it is not the sender email address.
   Sender's address	A sender email address verified in the same Region. Replace the example notifications@example.com with your own valid address.
   SMTP Password	Generated SES SMTP password or password derived for the selected Region. Do not enter the original Secret Access Key.
   Recipient address	An accessible test mailbox for delivery checks. In the SES sandbox, the address or its domain must be verified.

   note

   SES authentication and the sender email address serve different purposes. Explicitly enter a verified sender address even if Sender's address is not marked as required. An Access Key ID is not an email address.

5. Click Test sending and receiving. Check the on-screen result and verify receipt in the test mailbox. Resolve errors before saving. Confirm both successful sending and actual delivery.

6. After confirming the test result, click OK to save.

Troubleshooting

Symptom	Check
SMTP authentication fails	Check the SMTP username, SMTP password, and endpoint Region. Do not use the original Secret Access Key or temporary credentials.
SES rejects an unverified identity	Check that Sender's address is verified in the current Region. In the sandbox, also check recipient verification.
Sending is not authorized	Ask the AWS administrator to check effective ses:SendRawEmail permissions and applicable deny policies.
Connection timeout or TLS failure	Check the endpoint, port, encryption method, and outbound network rules for the NineData service. Keep encryption enabled.
Sending succeeds but the message is missing	Check the recipient address, spam folder, quarantine rules, and SES bounce information. A sending notification does not confirm receipt.

For AWS response details, see SES SMTP troubleshooting.

Recovery and credential management

If notifications fail after switching, reopen the email configuration dialog and restore the previous server, port, encryption method, username, sender address, and credentials. Test delivery before saving. Retain the old credentials until recovery is no longer needed.

Have the AWS administrator clean up identities, IAM users, groups, policies, and credentials created only for testing after confirming that no service still uses them. Retain identities and credentials used by the active email service. Follow your organization's policy for credential rotation.

For general SMTP settings, see Configure email service.