MailWizz AWS SES Integration — Delivery Server Setup, Bounce Configuration, and Sending Limits

Amazon SES is a common SMTP relay choice for MailWizz deployments that do not require dedicated IPs. This guide covers the SES Delivery Server configuration, SNS notification handling for bounces and complaints, and SES-specific limitations compared to dedicated infrastructure.

MailWizz SES Delivery Server Configuration

# Backend → Servers → Delivery Servers → Add New
# Type: Amazon SES (or SMTP with SES SMTP credentials)

# SMTP settings:
Hostname: email-smtp.us-east-1.amazonaws.com
Port: 587
Username: [SES SMTP user - NOT AWS access key]
Password: [SES SMTP password]
Protocol: TLS

SES SMTP Credentials vs API Credentials

SES SMTP credentials are generated separately from AWS IAM access keys. In SES console: Account dashboard → Create SMTP credentials. The SMTP username and password are different from your AWS access key ID and secret.

SNS Bounce and Complaint Notifications

# SES sends bounce/complaint notifications via SNS topics
# Configure in SES: Verified identities → Notifications
# Set up SNS topics for:
# - Bounces: POST to MailWizz bounce notification endpoint
# - Complaints: POST to MailWizz complaint notification endpoint

# MailWizz SES notification endpoint:
https://yourdomain.com/index.php?page=mailings/aws-ses-notification

SES Sending Limits

• New SES accounts start in sandbox — can only send to verified addresses
• Request production access through SES console before sending to external recipients
• Default sending rate: 14 messages/second; request increase via AWS Support if needed
• SES does not provide dedicated IPs by default — use SES dedicated IP pools for reputation isolation

Troubleshooting Common Issues

Production MailWizz deployments encounter predictable issues at predictable stages. Understanding the diagnostic workflow for the most common problems in this configuration area saves time and prevents the escalating complexity that comes from applying fixes to a misdiagnosed problem. The diagnostic approach is always the same: identify the symptom precisely (not just "it's not working"), isolate the layer where the failure occurs (MailWizz application, delivery server connection, DNS, ISP rejection), and fix at the correct layer.

Systematic Diagnosis Approach

Check MailWizz logs first (available in Backend → Misc → Application Logs), then check the delivery server SMTP logs, then check the PowerMTA accounting log. Most issues surface in one of these three places. A problem that does not appear in any of these logs is almost always a configuration issue — the system is not attempting what you expect it to attempt.

# MailWizz diagnostic log locations:
# Application logs: Backend → Misc → Application Logs
# Delivery logs: Backend → Campaigns → [Campaign] → Delivery Logs
# Bounce logs: Backend → Bounce Servers → [Server] → Logs

# Server-side logs:
# MailWizz application: /path/to/mailwizz/apps/common/runtime/application.log
# PowerMTA delivery: /var/log/pmta/pmta.log
# PowerMTA accounting: /var/log/pmta/accounting.csv

Performance Optimization for Production Scale

MailWizz performance at scale depends on three infrastructure layers: the web application server (PHP/nginx or Apache), the database (MySQL — query optimization is critical at high subscriber counts), and the delivery infrastructure (PowerMTA connection pool sizing). Performance problems in any of these layers manifest as slow campaign sends, delayed processing, or timeouts that appear unrelated to the specific configuration area being managed.

The most common performance constraint in production MailWizz environments is MySQL query efficiency. As subscriber lists grow beyond 500,000 records, unoptimized database queries for segmentation, bounce processing configuration, and campaign statistics become significant bottlenecks. Ensure that subscriber tables have appropriate indexes on email, status, date_added, and any custom field columns used for segmentation.

# MySQL optimization for large MailWizz installations
# Check slow query log:
SHOW VARIABLES LIKE 'slow_query_log%';
SET GLOBAL slow_query_log = 'ON';
SET GLOBAL long_query_time = 1;  # Log queries over 1 second

# Key indexes to verify exist:
SHOW INDEX FROM mailwizz_lists_subscribers;
# Should have indexes on: email, status, date_added, list_id

# Add missing index if needed:
ALTER TABLE mailwizz_lists_subscribers 
  ADD INDEX idx_email_status (email, status);
  
# Campaign sends table — index on campaign_id + subscriber_id:
ALTER TABLE mailwizz_campaigns_tracking_opens
  ADD INDEX idx_campaign_sub (campaign_id, subscriber_id);

Security Considerations

MailWizz installations handling production sending volumes are valuable targets. Key security practices: use HTTPS for all MailWizz access (including tracking and unsubscribe links), restrict Backend access to authorized IP ranges via web server configuration, rotate API keys periodically and revoke unused keys, maintain regular database backups (automated, offsite), and ensure PHP and MailWizz are kept current with security patches.

The tracking domain (used for open and click tracking) requires special attention: it must have a valid SSL certificate (Let's Encrypt is acceptable), and its DNS records must point exclusively to your MailWizz server. A compromised tracking domain can redirect recipients to malicious sites or reveal subscriber click data to third parties.

Campaign Analytics Integration

Track this MailWizz configuration area through two complementary metric layers: MailWizz campaign statistics (open rate, click rate, bounce rate, unsubscribe rate) and PowerMTA accounting log data (ISP-specific deferral rate, bounce classification, queue depth). Gaps between the two layers reveal delivery problems invisible to MailWizz statistics alone — high MailWizz "sent" counts with elevated PowerMTA deferral rates indicate a queue buildup that campaign dashboards don't surface.

Review campaign metrics against your own historical baselines rather than industry benchmarks. Your list composition, acquisition source, and engagement history define what normal looks like for your environment. Use rolling 7-day and 30-day averages to distinguish trend changes from campaign-specific variance.

Implementation Checklist

Before deploying this configuration to production MailWizz, verify: delivery server connection test passes in Backend → Servers → Delivery Servers, cron jobs are running on the correct schedule, bounce server mailbox is accessible and IMAP credentials are valid, tracking domain has valid SSL and loads within 500ms, and PHP memory limit is set to at least 256MB.

After deploying, send a test campaign to a controlled list of seed addresses across Gmail, Outlook, and Yahoo. Verify Authentication-Results headers show dkim=pass and spf=pass in the received messages. Check that open and click tracking are registering correctly in MailWizz statistics. Confirm bounce processing is updating subscriber status within 15 minutes of a test bounce event.

For managed MailWizz environments operated by Cloud Server for Email, these verification steps are performed automatically after any configuration change. The managed service includes continuous monitoring of delivery server health, cron job execution, and tracking domain availability. Contact infrastructure@cloudserverforemail.com for information about managed MailWizz hosting.

AWS SES Limits and Monitoring Integration

AWS SES enforces per-second and per-day sending limits that vary by region and account age. New accounts start at 200 messages/day in sandbox mode. Production access requires requesting a sending limit increase through AWS Support. Monitor SES bounce and complaint notifications through SNS and feed them directly to MailWizz suppression to keep account reputation clean.

SES vs Dedicated Infrastructure Trade-offs

AWS SES provides infrastructure without IP reputation management overhead, but gives no control over the IP pool you share with other SES users. For senders above 500,000 monthly messages with strict deliverability requirements, dedicated PowerMTA infrastructure provides the control that SES cannot. SES works well as a transactional email complement to a dedicated bulk sending infrastructure.