AWS SES Setup Guide

Navigate to SES Console

Go to the Amazon SES Console.

Verify Domain

Click Verified identities > Create identity > Domain.

Enter your domain (e.g., mail.yourdomain.com).

Add DNS Records

SES will provide DNS records to verify ownership and enable DKIM:

Wait for Verification

Verification can take up to 72 hours, but usually completes within minutes.

Navigate to Account Dashboard

In SES Console, go to Account dashboard.

Request Production Access

Click Request production access and fill out the form:

• Mail type: Transactional
• Website URL: Your application URL
• Use case description: Explain NornWeave’s purpose (AI agent email management)

Wait for Approval

AWS typically approves within 24 hours.

Create IAM User

Go to IAM Console > Users > Add user.

• Name: nornweave-ses
• Access type: Programmatic access

Attach Policy

Create a custom policy with minimal permissions:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ses:SendEmail",
        "ses:SendRawEmail"
      ],
      "Resource": "*"
    }
  ]
}

Save Credentials

Copy the Access Key ID and Secret Access Key.

Create SNS Topic

Go to SNS Console > Topics > Create topic.

• Type: Standard
• Name: nornweave-ses-inbound

Create HTTPS Subscription

In your SNS topic, click Create subscription:

• Protocol: HTTPS
• Endpoint: https://your-server.com/webhooks/ses

Configure MX Record

Add MX record pointing to SES for your receiving subdomain:

Use the correct region endpoint for your SES setup.

Create Receipt Rule Set

In SES Console, go to Email receiving > Rule sets > Create rule set.

Name: nornweave-rules

Create Receipt Rule

Add a rule in your rule set:

1. Click Create rule
2. Recipients: Leave empty to match all, or specify addresses/domains
3. Actions: Add SNS action
   • SNS topic: Select nornweave-ses-inbound
   • Encoding: UTF-8
4. Enable spam and virus scanning: Recommended

Activate Rule Set

Select your rule set and click Set as active.

Restart NornWeave

docker compose restart api

Check Logs for Subscription Confirmation

docker compose logs -f api

You should see: “SNS subscription confirmed successfully”

Create a Test Inbox

curl -X POST http://localhost:8000/v1/inboxes \
  -H "Content-Type: application/json" \
  -d '{"name": "Test", "email_username": "test"}'

Test Receiving

Send an email to test@mail.yourdomain.com from your personal email.

Test Sending

curl -X POST http://localhost:8000/v1/messages \
  -H "Content-Type: application/json" \
  -d '{
    "inbox_id": "ibx_test",
    "to": ["your@email.com"],
    "subject": "Test from NornWeave",
    "body": "Hello from NornWeave via SES!"
  }'

Create S3 Bucket

Create an S3 bucket to store incoming emails:

aws s3 mb s3://nornweave-ses-emails --region us-east-1

Update S3 Bucket Policy

Add a policy allowing SES to write to the bucket:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {"Service": "ses.amazonaws.com"},
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::nornweave-ses-emails/*",
      "Condition": {
        "StringEquals": {
          "AWS:SourceAccount": "YOUR_ACCOUNT_ID"
        }
      }
    }
  ]
}

Update Receipt Rule

Modify your receipt rule to:

1. First action: S3 (store the email)
2. Second action: SNS (notify NornWeave)