There are two ways to send mail from infrastructure you control: relay it through a managed service such as Amazon SES, or run a mail server yourself on a host with outbound port 25 open. They are not interchangeable.
Quick comparison
| Amazon SES | Self-hosted SMTP | |
|---|---|---|
| Setup effort | Domain verification and authentication records | Full mail server administration |
| IP reputation | Managed by AWS, shared or dedicated | Entirely yours to build and defend |
| Deliverability | Strong, provided you keep rates low | Depends wholly on your own work |
| Receiving mail | Limited | Full control |
| Ongoing work | Monitor bounces and complaints | Patching, blocklists, queues, reputation |
| Accounts here | 2 configurations from $750 | Port 25 open options on several providers |
Choose SES when you are sending application mail
Receipts, password resets, notifications and transactional messages should go through a relay. SES handles retry logic, reputation management and infrastructure so you do not.
Getting out of the SES sandbox requires an approved production access request describing what you send, how recipients opted in, and how you handle bounces and complaints. Our SES accounts are supplied already out of sandbox with 50K and 100K daily sending limits. See production access explained.
Choose self-hosted when you need to be a mail server
- You must receive and relay mail, not just send it.
- You are running a mail appliance or gateway that speaks SMTP natively.
- You need complete control over the sending path for a specific reason.
This requires an account with outbound port 25 open, since nearly every provider blocks it by default to protect IP reputation. Configurations with port 25 opened exist on DigitalOcean, Linode, Hetzner, OVHcloud and Kamatera.
What self-hosting actually costs you
The server is cheap. The work is not:
- Reverse DNS matching your sending hostname.
- SPF, DKIM and DMARC, correctly aligned. See authentication setup.
- Gradual IP warming. A cold IP sending at volume gets filtered.
- Blocklist monitoring and delisting requests.
- Queue management, retry policy and bounce processing.
- Patching a service that is permanently internet-facing.
An open port is necessary and nowhere near sufficient. See SMTP port 25 across providers.
The middle path
Run your own mail server for receiving and internal routing, and relay outbound through SES on port 587. You get control over inbound without owning outbound reputation, which is where most of the pain lives.
Which should you choose
- Application email only? SES.
- Bulk marketing? A service built for it, not a fresh cloud IP.
- Need to receive mail? Self-hosted, or a hybrid.
- Appliance or gateway requirement? Self-hosted with port 25 open.
Common questions
Why is port 25 blocked by default?
Shared IP reputation. One abusive tenant can get whole ranges listed, so providers block it pre-emptively.
Will my mail deliver if I self-host correctly?
With correct authentication, reverse DNS and careful warming, yes, but it is ongoing work rather than a one-off setup.
Can I use SES from a non-AWS server?
Yes. SES is reachable over SMTP or API from anywhere.