BIG BOX Hosting Compare vs Amazon SES № 03.04

Amazon SES at USD 0.10
per thousand.

The cheapest serious email infrastructure in the market on a pure per-message basis. We do not pretend to compete on raw price — we compete on operational depth, EU sovereignty, and the cases where SES's account-level constraints stop fitting. The honest comparison below; cases where SES is still right; cases where it is not.

00  /  The honest answer

Where SES wins, where it doesn't.

We will not pretend to be cheaper than SES at the per-message line. SES is the cheapest serious email infrastructure in the world for AWS-native teams running clean transactional traffic at modest volumes. The gap closes — and reverses — once you factor in the operational work AWS leaves to you, the dedicated IP add-on, the 5XX-error handling, and the EU sovereignty exposure. For teams handling European customer data, the comparison is not close.

2026 verdict

For pure-transactional, AWS-native, sub-1M/month, no-EU-data senders, SES wins decisively on cost. For everyone else — anyone past 1M/month, anyone marketing-heavy, anyone with European subscribers, anyone whose engineering team is not deep on AWS deliverability internals — our SMTP Relay or dedicated KumoMTA hosting deliver materially better outcomes once the total cost of ownership is honest.

SES's strength is the AWS economics and the integration with the rest of the AWS stack (CloudWatch, SNS, EventBridge, IAM). That strength is real but situational. The senders who migrate from SES to us are usually leaving for two reasons: SES's account-level deliverability controls hit a ceiling at scale, and the EU customer-data exposure became an active compliance issue.

─────────────────────────────────────────────────────────────────────────
01  /  Dimensions

Five ways the maths changes.

Each dimension below is the place where the SES-vs-managed-MTA comparison either confirms SES is right for you or reveals the hidden costs that the per-message price masks.

Dimension 01

The per-message price

The argument SES wins on without help. USD 0.10 per 1,000 emails when sending from EC2 is the cheapest in the market.

Amazon SES

USD 0.10 per 1,000 emails from EC2. USD 1.00 per 1,000 emails from outside AWS. No monthly minimum, no flat fee for the API itself. At 1M emails a month from EC2 the bill is USD 100. At 10M it is USD 1,000. At 100M it is USD 10,000. Amazon's pricing has been stable on this metric for years and the economics are genuinely hard to argue with on raw cost-per-message.

BIG BOX

Flat-fee tiers: €89/month for 100K, €259/month for 250K, €599/month from 500K. Past 1M, dedicated KumoMTA at €299-649/month (effectively unlimited within hardware capacity). At 500K emails/month our €599 lands at roughly USD 1.28 per 1,000 — about 3.8× the SES per-message price. The honest comparison: at this metric alone, SES is cheaper. The real maths needs the next four dimensions to be complete.

Dimension 02

The operational work AWS leaves to you

SES is infrastructure-as-a-service in the AWS sense — Amazon runs the engine; everything else is your responsibility. The hidden cost is the engineering time that work consumes.

Amazon SES

You handle: SPF, DKIM, DMARC setup and DNS publishing. IP warmup using SES's automated curve (which is generic, not list-tuned). Bounce and complaint event processing via SNS into your own analytics. Suppression list management (SES has a basic one; tuning it is your work). Per-domain throttling — SES's approach is account-wide, not per-receiving-domain. Reputation recovery if a bad campaign spikes complaint rate. The pricing is per message; the engineering work behind making the messages land is per engineer-hour.

BIG BOX

Authentication, IP warmup, bounce processing, suppression list, per-domain throttling, and reputation monitoring are all included in the price. Engineers on our side handle them; the application team writes application code. For teams with a deliverability engineer on staff (the typical SES shop) the time savings is roughly 8-15 hours/week of senior engineering attention. At Western European fully-loaded engineer rates that is meaningful money — usually exceeds the per-message price difference by month two.

Dimension 03

The dedicated IP economics

SES dedicated IPs are an add-on at USD 24.95 per IP per month, plus the per-message charge. The economics are favourable for very large senders and worse for the middle band.

Amazon SES

Dedicated IP at USD 24.95/IP/month, plus the per-message price. SES Standard dedicated IPs require manual warmup; Managed dedicated IPs are warmed automatically by Amazon at higher cost. For a sender doing 5M/month with two dedicated IPs from EC2: USD 500 (sending) + USD 50 (IPs) = USD 550/month. Reasonable economics at this scale, comparable to our €949 PowerMTA Multi-IP tier on price alone — and less operational depth.

BIG BOX

Dedicated IP included in plans from €259/month (1 IP, up to 250K) and €599/month (2 IPs, from 500K). Past 500K, dedicated MTA at €529/month (1 IP) or €949/month (multi-IP, 4-8 IPs across two PoPs). Effectively comparable per-IP cost at the SES Multi-IP equivalent volume; significantly lower at the entry tier where SES's IP add-on bumps the bill disproportionately.

Dimension 04

EU data sovereignty

The dimension where the comparison stops being close. Amazon SES is run by Amazon Web Services Inc., a U.S. corporation. The EU data exposure is structural.

Amazon SES

U.S. parent. CLOUD Act applies regardless of which AWS region the sending happens in — the eu-west-1 region's IPs are in Dublin but the corporate parent that operates the IPs is U.S.-based. AWS European Sovereign Cloud (announced 2023, EU-incorporated subsidiary) is a real product but adds significant cost and is not the standard SES offering. For senders with European subscriber lists subject to GDPR and the EU Data Act's Chapter VII obligations on cloud providers, SES's standard offering is increasingly an active compliance problem rather than a theoretical risk.

BIG BOX

Slovenian parent, no U.S. subsidiary, hardware in five European jurisdictions all outside CLOUD Act reach. The EU Data Act's third-country transfer obligations do not apply because there is no third-country transfer to characterise — both controller and processor are EU entities. For a Data Protection Impact Assessment, the analysis is materially simpler than the SES equivalent.

Dimension 05

Per-domain tuning

SES is account-level, not per-receiving-domain. Below a certain volume this is irrelevant; past it, the lack of per-domain control is the reason SES placement plateaus.

Amazon SES

Account-level configuration sets and IP pools provide some segmentation, but the throttling, the warmup, and the reputation tracking work at the account or pool level rather than per-receiving-domain. When Gmail starts throttling a specific IP for a specific reason, SES's response is a generic backoff rather than the per-domain decay that PowerMTA and KumoMTA deliver. For senders past 5M/month where 2-3 percentage points of placement difference is meaningful revenue, this is the ceiling SES hits and dedicated MTA alternatives keep growing past.

BIG BOX

Per-receiving-domain throttling is the central abstraction in PowerMTA's VirtualMTAs and KumoMTA's egress sources. Gmail, Microsoft, Yahoo, Apple, ProtonMail — each gets its own concurrency limit, message rate, and backoff policy, tuned to that mailbox provider's current behaviour and adjusted as their behaviour changes. This is the work that distinguishes a serious bulk sender's deliverability from an account-level relay's, and it is the single biggest reason senders past 5M/month migrate off SES even though the per-message price is lower.

─────────────────────────────────────────────────────────────────────────
01b  /  Engineer-hour TCO

SES is cheap. Until you count the hours.

Send-cost is the variable everyone quotes. Engineer hours is the variable that decides whether SES makes financial sense. The chart below maps actual TCO at 5 million monthly messages including the operational layer SES does not include — bounce processing, suppression list management, reputation monitoring, IP warmup, the dashboards and alerts that detect problems before they compound.

SES looks cheap because the price-per-message is genuinely low. €0.10 per thousand at high volume is below every other provider in this category. The price-per-message is also not the variable that decides whether SES makes financial sense. The variable is engineer hours. SES is infrastructure, not a managed service. Senders who run SES in production spend somewhere between 10 and 40 hours per month on the operational layer that SES does not include — bounce processing, suppression list management, reputation monitoring, IP warmup, DKIM rotation, the dashboards and alerts that detect problems before they compound. The chart below maps actual TCO at 5 million monthly messages including engineer hours at fully loaded €120 per hour.

Three lines on the chart at 5 million messages per month workload. SES alone (raw infrastructure cost) sits at roughly €500 per month in send fees plus a few euros for SNS, S3, CloudWatch. SES with internal engineering effort included at the typical rate of 25 hours per month sits at roughly €3,500 monthly. Our equivalent at the Multi-IP tier sits at €949 per month all-in. The chart is uncomfortable for the SES side. The send-cost gap that looks like a 10x advantage for SES inverts to a 6x disadvantage once the labour is included. We do not draw this chart to be smug. The labour cost is real. We draw it because most senders evaluating SES for the first time miss the labour cost in their model and rebuild the budget at month four when the actual hours show up on a timesheet.

// monthly cost (eur) at 5M messages/mo · send-cost vs all-in vs ours

Methodology: SES send-cost computed at €0.10 per thousand × 5 million = €500/month, plus €30 estimated for SNS topic delivery, S3 log archiving, CloudWatch alarms. Engineer hours estimated at 25 hours/month from interview data across 6 senders running SES in production at this volume range during 2024-2025, fully loaded at €120/hour = €3,000. Total SES all-in: ~€3,530/month. Variance: senders with mature internal tooling and dedicated deliverability engineers can run SES at lower hourly load (10-15 hours); senders without internal tooling commonly hit 35-40 hours in months when reputation incidents land. BIG BOX number is the published Volume tier price.

The honest framing is that SES wins for senders with engineering depth and time to invest in the operational layer, and we win for senders who would rather buy that layer pre-built. Companies like Netflix and Reddit run SES at huge scale because they have entire teams maintaining the bounce processing, suppression management, and reputation tooling around it. A growth-stage company with one engineer who is also responsible for half a dozen other systems does not have that depth. For them, SES looks cheaper on month one and is more expensive every month after. The decision is not about price. It is about which operational layer your team should be spending their hours on, and the answer to that question is rarely "the one our managed-service vendor would charge €949 per month to run for us."

─────────────────────────────────────────────────────────────────────────
02  /  The decision

When which.

We genuinely send people back to SES every month for the cases where SES is the right answer. Below is the honest split.

Stay on Amazon SES when

  • You are AWS-native (everything else of yours runs on AWS) and the integration with CloudWatch, SNS, EventBridge, and IAM is part of your operational fabric.
  • Your traffic is purely transactional — password resets, order confirmations, receipts, OTP codes — with effectively zero complaint rate and stable engagement.
  • You are sending under 1M emails/month and the absolute monthly cost difference is small compared to the migration overhead.
  • Your team has a senior engineer fluent in AWS deliverability internals (SES configuration sets, dedicated IP pools, SNS event routing, suppression list maintenance) and the operational work is genuinely cheap for you.
  • Your subscriber list is U.S.-based with no EU recipients and the CLOUD Act exposure is genuinely irrelevant to your situation.
  • You have AWS credits available that materially offset the per-message bill.

Migrate off SES when

  • You are past 5M emails/month and per-domain placement tuning has become the ceiling on your deliverability.
  • You have European subscribers in your list and the CLOUD Act exposure is now a documented compliance issue rather than an abstract one.
  • You run marketing campaigns alongside transactional traffic and the lack of true stream separation has caused at least one cross-contamination incident.
  • Your AWS account is hitting SES sending quota or reputation issues that AWS Support is slow to resolve.
  • You are migrating off AWS for unrelated reasons and the SES retention is incidental.
  • Your team does not have the AWS deliverability fluency to operate SES well, and the operational cost has been absorbed quietly by the application team.
  • You need a vendor who is on the phone within 4 hours when something goes wrong, not a support ticket queue.
─────────────────────────────────────────────────────────────────────────
02b  /  The shared-reputation problem

What happens when you start cold on SES.

Cold-start IP reputation on SES works differently than on managed providers, and the difference shows up in placement numbers during the first 4-6 weeks. Below: the actual placement metrics — SmartScreen plus Gmail plus Yahoo — we have measured for new SES IPs in EU-Frankfurt against the same metrics for properly warmed dedicated IPs. The gap is real and it has a cost the price page does not show.

Cold-start IP reputation on SES works differently than on managed providers and the difference matters more than most senders realise. SES allocates new IPs from a pool, and those IPs come with the aggregate reputation of every other SES customer who has ever sent from them. The default position is "shared reputation, mostly fine, occasionally surprising." For a high-volume sender that is acceptable. For a sender at 100k-500k volume with brand sensitivity it is a problem. The shared IP can have its reputation degraded by another customer who got aggressive with their list and the receiver does not separate per-customer reputation cleanly within shared IP space.

The numbers we have measured. New SES IPs in the EU-Frankfurt region show median Microsoft SmartScreen rating of 78 percent at start, against the 95 percent rating typical of a properly warmed dedicated IP. Gmail engagement classifier weights the new IP somewhere in the middle 60s for the first three weeks. Yahoo is harshest — new SES IPs in EU-Frankfurt routinely hit Yahoo deferral rates of 8 to 12 percent in the first 14 days, against the 1 to 2 percent typical of a managed warmup. The recovery happens. SES IPs reach steady-state reputation within 4 to 6 weeks of consistent sending. The cost is the lost placement during those 4 to 6 weeks. For a sender doing 200,000 monthly messages at 70 percent placement instead of 95 percent, the gap translates to roughly 50,000 messages going to spam during the warmup window. That is the part the price page does not show.

SES does offer dedicated IPs as an upgrade. The cost is €25 per IP per month plus the standard send fees, which is genuinely good value. The catch is that the dedicated IP comes from AWS's pool with no warmup history of its own, and the warmup is the customer's responsibility. SES provides automated warmup tooling that ramps the IP slowly over the first month, but the tooling does not have feedback loops the way a hand-managed warmup does — it sends to a fixed schedule regardless of whether the receivers are pushing back. We have audited senders who used SES dedicated IPs with the automated warmup, hit a Yahoo wall on day 11, and the SES tooling kept ramping the volume because it has no signal that something went wrong. The dedicated IP option fixes the shared-reputation problem. It does not fix the lack of operational feedback.

─────────────────────────────────────────────────────────────────────────
03  /  Migration

SES → us, in practice.

SES migrations are the ones we are most cautious about. The reason: SES users are typically more technically sophisticated than SendGrid or Mailgun users, and the migration value-prop is harder to articulate against the per-message price. We do these migrations carefully, with explicit modelling of the total-cost-of-ownership comparison before signing.

The application change is small. SES exposes both an SMTP endpoint and an HTTP API; both have direct equivalents on our side. For SES SDK users, the AWS SDK calls have to be replaced with HTTP requests — there is no compatibility shim because the AWS SDK is bound to AWS-specific signing logic. The replacement is usually trivial (10-50 lines of code per send-path) but it is more work than the SendGrid or Mailgun cutover.

The reputation transfer follows the standard pattern. Your domain reputation goes with you; the SES IP-level reputation does not. The new dedicated IPs warm on a 4-6 week curve. SES-specific note: if you were using SES Managed dedicated IPs (the auto-warmed tier), your IPs were never named to your DNS — they were SES's IPs, with their reputation. The warmup on our new IPs starts cleaner than from a SES-Standard configuration, but it still needs the full ramp.

The suppression list transfer requires SES API access. SES's account-level suppression list and per-configuration-set suppression are both pullable through the API; we extract both lists, deduplicate the union, and load the deduped set into our infrastructure before traffic flows. SES bounce and complaint events flowing through SNS for the last 90 days get pulled and reconciled — anyone who hard-bounced or complained on SES gets added to our suppression even if they were not in the SES suppression list (sometimes they were not, depending on how you configured the auto-suppression).

The traffic cutover is the standard 10%-increment parallel run with daily per-domain placement monitoring. The SES-specific risk we watch for is the SES sending quota reset behaviour — if you cut over too aggressively and your SES account goes to zero traffic for 30+ days, the SES sending quota resets and re-warming SES later would be expensive. Most clients keep a thin layer of low-volume traffic on SES through the migration window in case rollback is needed; we coordinate that with you explicitly.

About 1 in 4 SES migration calls ends with us building the total-cost-of-ownership model, showing it to the prospect, and concluding that SES is genuinely the right answer for their situation. The honest answer wins more long-term customers than the hard pitch — and it gives us a much higher hit rate on the calls where the migration is genuinely worth running. — SES migration intake notes, internal v4
─────────────────────────────────────────────────────────────────────────
04  /  Common questions

SES migration, specifically.

Questions we hear when AWS-native teams are evaluating the move off SES — typically around the engineer-hour TCO and the jurisdictional exposure inherited from AWS's parent. Cross-cutting topics (pricing tiers, support, deliverability methodology) are on the main FAQ.

01 If SES is so much cheaper per message, how do you compete on price at all? +
We do not compete on per-message price; we compete on total cost of ownership and outcomes. SES at USD 100/month for 1M emails looks unbeatable until you add the dedicated-IP cost (USD 25), the engineering time to handle warmup, suppression, and per-domain tuning (8-15 hours/week of senior engineering attention), and the placement difference at scale (2-5 percentage points lower inbox rate translates into real revenue impact for a marketing-heavy sender). Our €599/month Volume tier at 500K emails costs more on the headline than SES, but for a typical mid-market sender the total cost (subscription + engineer time + lost revenue from placement gap) often runs lower with us. We model this explicitly during the discovery call rather than asking you to assume our framing.
02 We use SES because everything else is on AWS. Do you integrate with AWS at all? +
We expose webhooks that any AWS-native event consumer can ingest — Lambda handler, EventBridge custom bus, API Gateway endpoint, whatever your team already uses for event-driven work. We do not integrate with IAM, CloudWatch, or SNS natively because we are not in AWS. For teams whose deliverability monitoring lives in CloudWatch dashboards alongside the rest of their infrastructure metrics, the migration involves rebuilding that monitoring on our Grafana dashboards or piping our Prometheus metrics into your existing Datadog/CloudWatch fleet. The work is real but bounded — usually a one-day engagement during onboarding rather than a sustained operational burden.
03 Our SES account has been throttled. Should we migrate or fix the SES side? +
Depends on why. If the throttle is structural (your sending pattern triggered SES's reputation system, you have a documented complaint-rate spike, AWS Support has identified the root cause), the right answer is usually fixing the SES side because the underlying behaviour follows you to any provider. If the throttle is operational (SES's account-level reputation systems are imprecise, the actual problem is per-domain rather than account-wide, AWS Support is slow to investigate), the migration to a dedicated MTA can resolve it because the new infrastructure starts from a clean slate with per-domain control. We will diagnose this during the call before quoting a migration. The diagnostic itself takes 1-2 hours and is free.
04 What about AWS European Sovereign Cloud — does that solve the CLOUD Act issue? +
Partially. AWS European Sovereign Cloud is a real product — an AWS subsidiary incorporated in the EU, intended to operate independently from AWS Inc. for compelled-disclosure purposes. Whether it actually achieves the separation that EU regulators are demanding is contested; Microsoft's June 2025 testimony to the French parliament was specific about why even subsidiary-level separation does not necessarily insulate from CLOUD Act reach when there is operational integration between U.S. parent and EU subsidiary. The honest answer in 2026 is that AWS European Sovereign Cloud reduces some categories of exposure but does not eliminate the CLOUD Act risk — and it costs significantly more than standard SES, often comparable to or higher than our pricing for similar functionality. Worth evaluating for AWS-native shops with strong sovereignty requirements; not a silver bullet.
05 Will my SES sending quota reset if I migrate? +
Yes, eventually. SES sending quotas are based on rolling 24-hour and per-second sending rates that AWS adjusts based on your usage pattern. If you cut SES traffic to zero, the quota stays at your current level for ~30-60 days then begins to decay; full reset happens after several months of inactivity. For migrations where rollback might be needed, we recommend keeping 5-10% of traffic on SES through the migration window (transactional only, low-engagement-risk) so the quota is preserved if you need to fall back. The cost of doing this is small (per-message price stays at SES's rate for the residual traffic) and the insurance value is real.
06 SES's automated IP warmup is convenient. Do you have an equivalent? +
We do, but it is structured differently. SES Managed dedicated IPs auto-warm using a generic curve that AWS controls — convenient, but not list-tuned. Our IP Warmup service is included in plans from €259/month (Sender tier and above) with engineer-attended ramps that adjust against your specific list quality and engagement profile. For SES Standard dedicated IP users who have already manually warmed, the ramp on our new IPs typically completes faster because your domain reputation is established — usually 3-4 weeks rather than the full 6-week conservative curve. We document the timeline explicitly during onboarding so the transition has no surprises.
07 Is the migration worth it if our SES bill is under USD 500/month? +
Probably not, unless one of the non-cost reasons applies (EU sovereignty, structural deliverability ceiling, marketing/transactional separation needs that SES cannot deliver cleanly). At under USD 500/month SES is genuinely competitive on TCO once you factor in the migration cost, and the integration with the rest of AWS is real value for AWS-native teams. We will tell you straight that you do not need to leave SES at this scale. The migrations that produce the best outcomes for clients are the ones at USD 1,500/month and up where the operational and sovereignty benefits compound, plus the per-message price difference becomes structural rather than incidental.
─────────────────────────────────────────────────────────────────────────
06  /  What SES doesn't include

The operational layer nobody itemises.

SES is infrastructure, not delivery service. The 18 items below are what every production sender ends up building or buying around it, distributed across AWS-composed tooling, external products, and pure engineering effort. Most are not in the SES first-year budget projection. All are in the SES second-year invoice when the engineering hours are honestly counted.

The honest framing of SES is that it is not an email service. It is an infrastructure component. You wire it into an email service you build yourself. The list below is what a production-grade email delivery operation requires beyond what SES ships out of the box, the things every sender at scale ends up building or buying separately and rarely accounts for in their first SES budget projection. Some items are AWS services you can compose into a workable equivalent. Some are external tools. Some are internal engineering effort that does not exist as a product anywhere on the market. All of them are line items that show up on your team's roadmap whether you anticipate them or not. Often at the worst time. The buyers who build their TCO model from this list arrive at the comparison with us already done.

Capability needed SES default What you build or buy
// reputation & deliverability
IP warmup with feedback Schedule-based, no feedback loop Custom feedback wrapper, ~80 hrs eng
Reputation monitoring CloudWatch metrics, basic Glock Apps / Ongage / custom dashboards
Postmaster Tools integration Not provided Manual setup at Gmail/Yahoo/Microsoft
SmartScreen visibility Not provided Microsoft SNDS registration + monitoring
// list & bounce hygiene
Bounce processing SNS topic delivers raw events Lambda + parser + categorisation logic
Suppression list management Account-level suppression, basic Custom multi-domain logic, pre-send check
Complaint handling SNS topic for FBL events Workflow to remove + reason-code logging
Email validation API Not provided ZeroBounce / Briteverify subscription
// authentication infrastructure
DKIM key rotation Manual, customer-managed Cron job + DNS automation + monitoring
DMARC monitoring Not provided Red Sift / Valimail / custom RUA parser
MTA-STS deployment Not provided DNS record + HTTPS-hosted policy file
BIMI infrastructure Not provided SVG hosting + VMC procurement + DNS
// observability & operations
Per-sender dashboards CloudWatch, single account view Multi-tenant aggregation layer in Grafana
Real-time deliverability alerts CloudWatch alarms, basic PagerDuty + multi-signal alert logic
Throttling per receiver Sending rate, account-level only Custom send pacer + receiver-aware logic
Incident response runbooks Not provided Internal runbooks, on-call rotation
// support & escalation
Engineer-level support AWS Premium Support tier required Business or Enterprise AWS plan, +€100-€15k/mo
Deliverability expertise on call Not provided Hire internal deliverability engineer or consultant

Eighteen items above. Some take a week to wire up. Some take quarters of engineering effort, particularly the reputation tooling and the suppression list infrastructure that nobody warns you about until you are already running at 5 million messages per month and the bounce rate starts mattering for real. The total accumulates to the engineer-hour cost in section 01b — that is where the 25 hours per month estimate comes from, distributed across these tasks at the cadence each one demands. We are not arguing that SES is wrong. We are arguing that SES is wrong if you do not have the team to build everything above it. For senders who have that team, SES wins. For senders who do not, the math is what we showed in the chart. None of this is hidden. It is rarely surfaced in the comparison conversation, and when we do surface it the buyer has already half-decided.

─────────────────────────────────────────────────────────────────────────

Bring the SES bill.

The honest SES comparison call is built around your actual SES usage data. Bring the last 3 months of your SES bill, your traffic profile, and your dedicated-IP configuration. We model the total cost of ownership against our infrastructure transparently — about 1 in 4 of these calls ends with us recommending you stay on SES because the maths does not justify migrating. The honest answer wins long-term customers.