Configuring AWS SES for Use with Kion SMTP

Last updated July 07, 2026 18:24

This article walks through setting up Amazon Simple Email Service (SES) from scratch so it can be used as the SMTP provider for Kion email notifications. If SES is already configured and you only need to rotate the SMTP password, see the SMTP article instead.

Overview

Kion sends notification emails through an SMTP relay. AWS SES is a common choice for customers already running in AWS, since it provides a managed SMTP endpoint with high deliverability. Setting SES up for Kion involves four steps:

Verify the sending identity (domain or email address) in SES.
Move the SES account out of the sandbox, if needed.
Create SMTP credentials.
Enter the SMTP host, port, and credentials into Kion.

Requirements

An AWS account with permissions to use SES and IAM.
Access to DNS management for the sending domain (to add verification and DKIM records).
Global Manage Kion System Settings permission in Kion.

Step 1: Verify a Sending Identity in SES

SES requires that you verify ownership of the email address or domain you intend to send from.

In the AWS Console, go to SES > Verified identities.
Choose Create identity.
Select Domain (recommended) or Email address.
- Domain verification allows sending from any address at that domain and supports DKIM signing.
- Email address verification only allows sending from that single address.
Follow the prompts to add the provided DNS records (TXT, CNAME, or MX depending on the option chosen) to your domain host.
Wait for AWS to confirm verification. This can take a few minutes to a few hours depending on DNS propagation.

Step 2: Request Production Access

New SES accounts start in the sandbox, which only allows sending to verified addresses and enforces a low sending rate. To send Kion notifications to your users, you will need production access.

In the SES console, go to Account dashboard.
Under Sending statistics, choose Request production access.
Complete the form describing your use case (e.g., "Transactional notification emails from an internal application").
AWS Support typically responds within 24 hours.

You can configure Kion's SMTP settings while still in the sandbox to test with verified addresses, but general notification delivery will not work until production access is granted.

Step 3: Create SMTP Credentials

In the SES console, go to SMTP settings.
Note the SMTP endpoint for your region (for example, email-smtp.us-east-1.amazonaws.com).
Choose Create SMTP credentials.
AWS creates a dedicated IAM user scoped to sending email through SES and generates an SMTP username and password.
Download and store the generated credentials. The password is only shown once at creation time.

Step 4: Configure SMTP in Kion

In Kion, go to Settings > System Settings > Application Settings > Email and Notifications > SMTP and enter the following:

Host. The SES SMTP endpoint for your region, e.g. email-smtp.us-east-1.amazonaws.com.
Port. Use 587 (STARTTLS) or 465 (implicit TLS). Port 25 is also supported but is often blocked by network providers.
From. An address at the verified domain or the verified email address from Step 1.
Username. The SMTP username generated in Step 3.
Password. The SMTP password generated in Step 3.
Skip SSL Verification. Leave disabled.

Save the settings, then send a test notification from Kion to confirm delivery.

Troubleshooting

Emails not arriving. Confirm production access has been granted and the recipient address is not on the SES suppression list.
Authentication errors. Confirm the host matches the region where the SMTP credentials were created. SES SMTP credentials are region-specific.
Connection timeouts. Confirm your Kion installation's outbound IP addresses (typically the NAT gateway elastic IPs) are allowed through your network's firewall on the chosen SMTP port.