Amazon SES

Production mode sends email from your own domain with no recipient restrictions. It requires a real domain and access to your DNS provider.

You do not need Route53. Any DNS provider works, whether that is Cloudflare, Namecheap, Porkbun, GoDaddy, Route53, or another provider.

Step 1: Configure Oolvay

Open config/emails.ts and set the provider and mode:

export const emailConfig = {
  provider: "ses" as "resend" | "postmark" | "ses",
  deploySesInfrastructure: true, // Set to true to provision SES domain infrastructure
}

support: {
    sender: `Team ${BRANDNAME}`,
    email: "you@example.com",
  },
  security: {
    sender: `${BRANDNAME} Security`,
    email: "you@example.com",
  },
  contact: {
    sender: `Team ${BRANDNAME}`,
    fromEmail: "you@example.com",
    toEmail: "you@example.com",
  },
  docsFeedback: {
    sender: `${BRANDNAME} Docs`,
    fromEmail: "you@example.com",
    toEmail: "you@example.com", // later change to `feedback@${BRANDDOMAIN}`
  },

  welcome: {
    sender: `${EMAILSENDERNAME} from ${BRANDNAME}`,
    fromEmail: "you@example.com",
  },

  subscriptions: {
    sender: `${BRANDNAME} Billing`,
    fromEmail: "you@example.com",
  },
  magicLink: {
    sender: `${BRANDNAME} Accounts`,
    fromEmail: "you@example.com",
    expiresInSeconds: 300, // 5 minutes
  },

The sender addresses will be updated in Step 6: Use branded sender addresses once your domain is verified and production access is granted.

Step 2: Deploy SES infrastructure

Run the deploy command with --all to include the SES identity stack alongside the core infrastructure stack.

bunx cdk deploy --all --app "bun run infra/app.ts" --profile dev-admin

This creates:

• An SES domain identity for your brand domain
• DKIM configuration
• The verification records AWS needs you to publish

Step 3: Add DNS records

When the deployment finishes, the terminal prints DNS records that AWS needs you to add to your domain. These typically include:

Copy these records into your DNS provider exactly as shown. Regardless of which DNS provider you use, log in, find the DNS management panel for your domain, and add each record.

Step 4: Copy outputs into .env.local

If you completed the Storage setup earlier, these values are already in your .env.local and the SES stack adds no new environment variables. You can skip this step.

If this is your first CDK deployment, the terminal output from the cdk deploy --all command in Step 2: Deploy SES infrastructure will print the following values. Copy them into your .env.local:

AWS_REGION=
AWS_ACCESS_KEY_ID=
AWS_SECRET_ACCESS_KEY=
AWS_S3_BUCKET_NAME=
NEXT_PUBLIC_CLOUDFRONT_URL=

Step 5: Request production access

By default, new SES accounts are restricted to sandbox mode. This step lifts that restriction so you can send email to any address without limitations.

Step 6: Update sender addresses

Now that your domain is verified and production access is granted, update config/emails.ts with your real sender addresses.

export const emailConfig = {
  provider: "ses" as "resend" | "postmark" | "ses",
  deploySesInfrastructure: true,
}

support: {
  sender: `Team ${