Contents
Hetzner and AWS represent two different approaches to cloud infrastructure that produce dramatically different outcomes for email server deployment. Hetzner is the European cloud provider widely preferred for self-hosted email: port 25 open by default on dedicated servers and most cloud plans, GDPR-native compliance under German law, 70-80% lower compute costs than AWS at equivalent specifications, 20TB egress included per cloud instance. AWS provides global infrastructure with 31 datacenters worldwide but blocks outbound port 25 by default with a request-based exception process; AWS's natural fit for email is the managed AWS SES service rather than self-hosted on EC2. The 2026 decision is rarely about Hetzner versus AWS directly; it is about whether self-hosted email infrastructure (Hetzner is the answer) or managed email service (AWS SES is the answer).
This comparison covers the practical decision between Hetzner and AWS for email infrastructure in 2026: the different philosophies each provider represents, the decisive port 25 question that determines suitability for self-hosted email, cost economics showing Hetzner's substantial advantages for compute and bandwidth, Hetzner's capabilities and limitations for email use cases, AWS's capabilities including the managed AWS SES service that bypasses the port 25 problem, GDPR and compliance posture differences between US-company AWS and German-company Hetzner, geographic coverage trade-offs, the hybrid pattern combining Hetzner for self-hosted infrastructure with AWS SES for managed sending, and the decision framework for choosing between them.
Two different philosophies
One philosophy: cheap, focused, European, technical. The other: comprehensive, global, expensive, managed.
Hetzner and AWS represent fundamentally different approaches to cloud infrastructure. Hetzner is a German company founded in 1997 focused on cost-efficient IaaS (Infrastructure as a Service): you get servers, you configure them, you run your stuff. The product line is narrow but deep: cloud servers, dedicated servers, storage. Pricing is transparent and consistent. Operational philosophy assumes technical capability from the customer; documentation supports DevOps teams who know what they want.
AWS is a US company founded in 2006 offering comprehensive cloud services across virtually every infrastructure and application category. Hundreds of services span IaaS, PaaS, SaaS, machine learning, databases, networking, security, compliance, and more. Pricing is complex with many dimensions affecting total cost. Operational philosophy assumes customers want managed services and integrations rather than building everything themselves; documentation is extensive but the surface area is overwhelming.
For email infrastructure specifically, the philosophies produce different patterns:
Hetzner's fit for email: self-hosted MTAs on dedicated or cloud servers. Operators install Postfix, PowerMTA, KumoMTA, or Postal on Hetzner infrastructure and run email themselves. Hetzner provides the network, IPs, and hardware; the operator provides everything above.
AWS's fit for email: AWS SES managed service. Operators consume AWS SES API for transactional and bulk email; AWS handles infrastructure, deliverability tooling, and operations. Self-hosting email on AWS EC2 is technically possible but operationally awkward due to port 25 restrictions and cost disadvantages.
The choice is rarely Hetzner vs AWS for the same use case; it is more often about whether the use case is self-hosted (Hetzner) or managed (AWS SES). The hybrid pattern combines both: Hetzner for self-hosted infrastructure, AWS SES for specific managed sending streams.
The decisive port 25 question
Port 25 is the standard SMTP port for server-to-server email delivery. Mail servers must connect to recipient mail servers on port 25 to deliver outbound messages. Cloud provider port 25 policies determine whether self-hosted email is practical.
Hetzner port 25 policy:
- Dedicated servers: Port 25 open by default. No restrictions or special requests needed. Mail servers run normally.
- Cloud servers: Port 25 open by default on most plans. Some restrictions exist on certain low-tier or specific configurations but generally permissive.
- PTR records: Configurable through Hetzner Robot (dedicated) or Cloud Console (cloud); supports custom PTR setup needed for mail server credibility.
- IPv6: Allocated by default with appropriate PTR support.
- Abuse handling: Hetzner responds to abuse complaints; legitimate operators rarely have issues but spam abuse triggers termination.
AWS EC2 port 25 policy:
- Default: Outbound port 25 blocked on all EC2 instances. New accounts cannot send mail directly via port 25.
- Exception process: Customers can submit a request through AWS Support to remove the port 25 restriction. The request must include legitimate business justification and detailed sending plans.
- Approval rate: Approval is not guaranteed; many requests are denied. AWS prefers customers use SES rather than self-hosted mail servers on EC2.
- Even with approval: Some sending limits typically apply; full unrestricted port 25 access requires additional justification.
The port 25 difference has practical consequences:
For self-hosted email on Hetzner: provision a server, configure the mail server (Postfix, Exim, PowerMTA, etc.), configure DNS (MX, SPF, DKIM, PTR), start sending. The whole process can complete in hours from start to operational.
For self-hosted email on AWS EC2: provision an EC2 instance, submit port 25 exception request to AWS Support, wait 24-72 hours for response, may receive denial requiring further justification or alternative approach (use SES), eventually configure mail server if approved, configure DNS. The process can take weeks and may end in failure.
The port 25 issue is the single most important factor that determines suitability of cloud providers for self-hosted email. Hetzner's permissive policy positions it as the standard choice for self-hosted email infrastructure in Europe and globally; AWS EC2's restrictive policy positions it as inappropriate for self-hosted email regardless of other capabilities.
Cost economics in detail
Cost comparison between Hetzner and AWS at typical email server configurations:
| Specification | Hetzner pricing | AWS EC2 pricing | Difference |
|---|---|---|---|
| 2 vCPU / 4GB RAM / 80GB | €4.15/month (CX22) | ~$15-20/month (t3.medium) | Hetzner 70% cheaper |
| 4 vCPU / 16GB RAM / 160GB | €23.75/month (CX42) | ~$120/month (m5.xlarge) | Hetzner 80% cheaper |
| 8 vCPU / 32GB RAM / 240GB | €38/month (CX52) | ~$240/month (m5.2xlarge) | Hetzner 80% cheaper |
| Dedicated 6 cores / 64GB RAM | €39/month (AX41-NVMe) | $400+/month equivalent | Hetzner 90% cheaper |
| Dedicated 16 cores / 128GB RAM | €85-120/month (AX-line) | $1,000+/month equivalent | Hetzner 85% cheaper |
| Bandwidth outbound | 20TB included; €1/TB after | $0.09/GB after 100GB free | Hetzner 95%+ cheaper |
| Additional IPv4 | ~€1/month with justification | $3.65/month per Elastic IP | Hetzner cheaper |
| Snapshot storage | ~€0.01/GB/month | $0.05/GB/month | Hetzner 80% cheaper |
The cost differences compound across deployment patterns:
Single mail server (100K-500K monthly emails): Hetzner Cloud CX42 at €23.75/month vs AWS m5.xlarge at $120/month plus egress costs. Annual saving: approximately $1,100-1,500.
Multi-server cluster (1M-5M monthly emails): 4-node Hetzner cluster at €100-200/month total vs equivalent AWS deployment at $600-1,200/month plus substantial egress. Annual saving: $6,000-12,000.
High-volume operation (10M+ monthly emails): Multi-server Hetzner dedicated cluster at €500-2,000/month vs equivalent AWS bare-metal or EC2 deployment at $3,000-15,000/month plus egress. Annual saving: $30,000-150,000+.
The bandwidth cost difference is particularly significant for email infrastructure. Email programmes can generate substantial outbound traffic (tens of TB monthly for high-volume operations); AWS egress at $0.09/GB produces bills that scale linearly with sending volume, while Hetzner's included 20TB per instance combined with €1/TB beyond covers most operations within the included allocation.
AWS pricing comparisons typically use on-demand rates. Reserved Instances (1 or 3 year commitments) and Savings Plans reduce AWS costs by 30-60% versus on-demand. For long-term workloads, the AWS effective cost is lower than on-demand suggests. However, even with 60% reserved instance discount, AWS compute remains 40-50% more expensive than Hetzner at equivalent specifications; the gap narrows but does not close. Hetzner's pricing has no comparable commitment-based discount system because their pricing is already low; the apparent simplicity is itself a cost advantage (no need to manage reserved instance lifecycle, no risk of unused commitments, no need to predict workload growth accurately enough to optimise commitments).
Hetzner capabilities for email
Hetzner's capabilities for email infrastructure:
Hetzner Cloud. Cloud VPS service with predictable pricing, hourly billing capped at monthly maximum, simple control panel. Plans range from CX22 (2 vCPU, 4GB RAM, €4.15/month) to CCX series with dedicated CPUs for high-performance workloads (up to 48 vCPU, 192GB RAM). Suitable for moderate-volume mail servers (under 1M monthly typically).
Hetzner Robot dedicated servers. Bare-metal servers with substantial hardware. Modern AMD EPYC and Intel Xeon options; 32-256GB RAM; NVMe storage; 1Gbps network with 10Gbps available. Auction-style pricing for older configurations produces additional savings. Suitable for high-volume mail servers (1M-50M+ monthly).
Network features. 1Gbps included on cloud servers; 10Gbps available on higher-tier dedicated servers. Hetzner's network is well-connected with substantial peering in Europe. Latency to European recipients excellent; to North American or Asian recipients respectable through transit.
IP allocation. Cloud instances get 1 IPv4 + 1 IPv6 included; additional IPs available at low cost (€1-3/month). Dedicated servers can request multiple IP subnets with justification. PTR records configurable through control panels.
European focus. Two datacenter locations: Nuremberg/Falkenstein Germany and Helsinki Finland. Network presence concentrated in Europe; deliverability and latency optimised for European recipients. Limited US presence (Ashburn, Hillsboro for cloud) emerging in recent years.
Operational philosophy. Self-service oriented. Documentation good but assumes technical competence. Support exists but is not extensive; expects operators to handle most issues. Suits DevOps teams comfortable with Linux administration.
Hetzner limitations for email:
- Geographic concentration: limited presence outside Europe affects programmes serving global audiences
- No managed email service: must self-host MTAs (or use external SaaS providers from Hetzner servers)
- Limited compliance certifications: ISO 27001 and GDPR-native but lacks HIPAA BAA, FedRAMP, SOC 2 Type II
- Support tier: basic support included; premium support tier limited compared to AWS Enterprise Support
- Region failover: limited geographic redundancy options within Hetzner alone
AWS capabilities for email
AWS's capabilities for email infrastructure span multiple service categories:
AWS EC2. Comprehensive compute service with hundreds of instance types. For email specifically, the port 25 block makes EC2 inappropriate for self-hosted mail servers without exception approval. EC2 fits when running surrounding application infrastructure that integrates with AWS SES.
AWS SES (Simple Email Service). Managed email service avoiding the port 25 issue entirely. Provides SMTP submission and REST API for sending; pricing at $0.10 per 1,000 emails plus $24.95/month per dedicated IP option. SES is widely used and produces good deliverability through AWS's established sending infrastructure. The managed model fits AWS's overall philosophy of comprehensive cloud services.
AWS WorkMail. Managed business email service for corporate email use cases. Comparable to Microsoft 365 Exchange for AWS-centric organisations. Not directly comparable to Hetzner self-hosted email but covers different use case.
AWS Lambda + SES integration. Serverless functions can trigger SES sending naturally. Useful for event-driven email workflows where infrastructure-less sending fits the architecture.
AWS Route 53. DNS service with native integration for SES authentication setup. SPF, DKIM, DMARC configuration through Route 53 is well-documented and integrates with broader AWS infrastructure.
AWS CloudWatch. Monitoring and logging service. Integrates with SES for delivery monitoring; provides dashboards for sending metrics.
AWS Networking services. VPC, NAT Gateway, Direct Connect for private connectivity. Substantial sophistication for hybrid cloud and enterprise networking patterns.
Compliance portfolio. HIPAA BAA available; FedRAMP authorisation; SOC 2 Type II; PCI DSS; ISO 27001; many regional certifications. Substantially broader than Hetzner.
AWS limitations for email:
- Port 25 block on EC2 makes self-hosted MTAs impractical without exception approval
- Cost: 4-7x more expensive than Hetzner at equivalent compute specifications
- Bandwidth costs: $0.09/GB egress produces substantial bills for email programmes
- Complexity: many services and options; pricing complexity affects predictability
- US company: subject to US laws including CLOUD Act regardless of region used
- SES limitations: managed service has fewer customisation options than self-hosted MTAs
GDPR and compliance posture
The GDPR posture differs substantially between Hetzner and AWS, with implications for European operators.
Hetzner GDPR posture:
- German company under EU law. Hetzner is incorporated in Germany; operations fall under EU GDPR and German data protection law (BDSG) jurisdiction.
- EU-only data centers (primary). Germany and Finland datacenters keep data in EU jurisdictions. Recent US datacenter additions are explicit US-located for customers wanting US presence.
- Standard Data Processing Agreement (DPA). Hetzner provides DPA covering GDPR processor obligations.
- No CLOUD Act exposure. US CLOUD Act allows US authorities to demand data from US companies regardless of data location. Hetzner is not a US company; CLOUD Act does not apply.
- Strong data protection track record. German data protection authorities are among the strictest globally; Hetzner operates under these requirements as standard practice.
AWS GDPR posture:
- US company. AWS is part of Amazon, a US company. US laws including the CLOUD Act apply to AWS even when data is in EU regions.
- EU regions available. Frankfurt, Ireland, Paris, Stockholm, Milan datacenters keep data physically in EU but the legal jurisdiction of the parent company adds complexity.
- GDPR compliance tools. AWS provides extensive GDPR compliance documentation, DPAs, and configurations to support GDPR. Achievable but requires care.
- Privacy Shield invalidation impact. The 2020 Schrems II decision invalidated Privacy Shield between US and EU; AWS uses Standard Contractual Clauses (SCCs) as the transfer mechanism, which remain subject to ongoing legal scrutiny.
- Configuration complexity. Ensuring data stays in EU regions, avoiding accidental cross-region data transfer, managing employee access from US offices: all require careful configuration that adds operational burden.
The practical implications for email infrastructure:
For European businesses processing EU personal data through email programmes, Hetzner provides cleaner GDPR posture with less compliance complexity. The German company operating in EU datacenters under EU law eliminates several risk vectors that AWS introduces.
For global businesses with compliance requirements beyond GDPR (HIPAA, FedRAMP, SOC 2 Type II), AWS's compliance portfolio is necessary. Hetzner does not offer these compliance frameworks. The trade-off: AWS's broader compliance for organisations requiring it; Hetzner's cleaner GDPR for organisations focused on EU.
Geography and global coverage
The geographic coverage difference between Hetzner and AWS affects programmes serving global audiences.
| Region | Hetzner presence | AWS presence |
|---|---|---|
| Western Europe | Germany (Nuremberg, Falkenstein) | Multiple: Ireland, Frankfurt, Paris, London, Stockholm, Milan, Spain |
| Northern Europe | Finland (Helsinki) | Stockholm, Ireland |
| Eastern Europe | None | None (closest: Frankfurt) |
| North America East | Ashburn VA (cloud only) | N. Virginia, Ohio |
| North America West | Hillsboro OR (cloud only) | N. California, Oregon |
| Canada | None | Central (Montreal) |
| South America | None | São Paulo |
| Asia Pacific (East) | None (planned) | Multiple: Tokyo, Seoul, Singapore, Hong Kong, Sydney, Mumbai |
| Middle East | None | Bahrain, UAE, Israel |
| Africa | None | Cape Town |
The geographic implications:
For programmes serving primarily European audiences: Hetzner's coverage is excellent. Both German datacenters provide good latency to all major European markets; Finland datacenter adds Nordic optimisation.
For programmes serving North American audiences: Hetzner's recent US datacenter additions provide some coverage; AWS provides far more comprehensive North American options.
For programmes serving Asia-Pacific, Middle East, South America: Hetzner lacks presence; AWS provides comprehensive coverage. Hetzner-only programmes serving these regions need additional providers or accept transit latency.
For global programmes requiring presence in many regions simultaneously: AWS's 31 datacenters provide unmatched coverage; Hetzner alone cannot match this scope.
The hybrid pattern (Hetzner for European-centric workloads plus AWS for global reach) is increasingly common for operators wanting Hetzner's cost economics where appropriate while maintaining AWS's geographic reach where needed.
The Hetzner + AWS SES hybrid pattern
A common 2026 pattern combines Hetzner for self-hosted infrastructure with AWS SES for managed email sending.
The pattern architecture:
- Application servers on Hetzner. Web applications, APIs, databases run on Hetzner Cloud or dedicated servers for the cost economics
- Self-hosted email infrastructure on Hetzner. Marketing email and high-volume sending uses Postfix, PowerMTA, or KumoMTA on Hetzner servers for the cost economics and full control
- Transactional email through AWS SES. Critical transactional email (password resets, order confirmations, security alerts) uses AWS SES for the managed reliability and deliverability tooling
- DNS through Cloudflare or AWS Route 53. DNS hosting separate from compute platforms for flexibility
The pattern advantages:
Cost optimisation. High-volume marketing uses Hetzner's 70-80% cost advantage; critical transactional uses AWS SES managed simplicity. Total cost lower than pure-AWS while critical functions retain managed simplicity.
Reliability for critical streams. AWS SES has higher reliability and managed deliverability for transactional messages where delivery matters most. Self-hosted Hetzner infrastructure handles marketing where occasional issues are tolerable.
Vendor risk diversification. Multiple providers reduce dependency on any single vendor. If Hetzner has issues, AWS SES continues handling critical mail; if AWS has issues, Hetzner self-hosted continues.
Capability mix. Programmes get Hetzner's port 25 freedom for self-hosted while accessing AWS's managed services for specific needs.
The pattern complexity:
Multi-provider architecture is operationally more complex than single-provider. Monitoring, billing, security, and incident response span multiple platforms. The complexity is justified when the benefits outweigh the operational burden; many operators find the hybrid produces strong outcomes once established.
A SaaS client we worked with in 2024 illustrates the hybrid pattern. They had been running on AWS entirely: EC2 instances for application, AWS SES for email, RDS for database, multiple other AWS services. Monthly AWS bill: approximately $4,500 for infrastructure plus $200 for SES at their 800K monthly email volume. We architected a hybrid migration: applications moved to Hetzner Cloud (€300/month = approximately $325/month for equivalent compute); database moved to Hetzner managed alternative; email split between Hetzner self-hosted PowerMTA for marketing (~$200/month all-in) and AWS SES for transactional (~$80/month for transactional portion of 800K total). Migration timeline: 4 months total including PowerMTA warmup on Hetzner. Post-migration costs: approximately $605/month combined (Hetzner $325 + Hetzner email $200 + AWS SES $80). Annual savings: approximately $48,000 ($4,700/month combined AWS down to approximately $605/month combined Hetzner + AWS). Operational complexity: increased meaningfully but manageable; team gained DevOps capacity through the migration project. The lesson: hybrid Hetzner + AWS SES architectures produce substantial cost savings at moderate-and-above volumes while maintaining managed simplicity for critical email streams. The pattern is increasingly common for cost-conscious operators willing to manage multi-provider complexity.
Decision framework
The decision framework for Hetzner vs AWS for email infrastructure in 2026:
Choose Hetzner when: self-hosting email infrastructure on cloud servers or dedicated; primarily European market focus (GDPR posture cleaner, latency better); cost economics matter materially (70-80% savings vs AWS); team has DevOps capacity for self-managed infrastructure; operational simplicity preferred over comprehensive service catalogue; port 25 access is essential for the use case.
Choose AWS SES (not EC2 for email) when: managed email service is preferred over self-hosted; AWS ecosystem already in use for surrounding infrastructure; global compliance frameworks needed (HIPAA, FedRAMP, SOC 2 Type II); the simpler managed model better fits operational maturity; integration with AWS Lambda, SNS, SQS for event-driven email valuable; specific managed-service features (configuration sets, identity types, IP pool management) needed.
Use hybrid Hetzner + AWS SES when: programme has both high-volume marketing and critical transactional needs; cost economics matter for marketing volume but reliability matters for transactional; team has capacity for multi-provider architecture; vendor risk diversification is operationally valuable.
Avoid AWS EC2 for self-hosted email when: port 25 access is required (the block is a hard constraint); cost is a meaningful consideration (4-7x more expensive than Hetzner); the use case fits AWS SES better than self-hosted; the team would rather use managed services anyway.
Consider alternatives to both when: Hetzner's geography insufficient and AWS too expensive (OVH for similar cost economics with broader geography; DigitalOcean for simpler operational model than AWS with reasonable price; Vultr or Linode for specific use cases); the use case is small enough that managed services (SendGrid, Mailgun, Postmark) produce better outcomes than either Hetzner or AWS infrastructure.
The 2026 default recommendations:
- Self-hosted email at moderate-to-high volume: Hetzner (cost, port 25, GDPR)
- Managed email service: AWS SES (when AWS ecosystem fits) or Postmark/Mailgun (for managed services not requiring AWS integration)
- Hybrid architectures: Hetzner self-hosted + AWS SES transactional
- Avoid: AWS EC2 for self-hosted email (port 25 block + cost makes this impractical)
The framework treats Hetzner and AWS as solutions to different aspects of email infrastructure rather than direct competitors. When the use case is clear (self-hosted vs managed; European vs global; cost-sensitive vs feature-rich), the choice is usually clear. The comparison framing helps understand when each provider's strengths apply.