You chose SES for a reason
SES is the cheapest per-email sending infrastructure available. At $0.10 per 1,000 emails, with no minimum commitments and full control over your sending domain, it is the rational choice for engineering teams that want to own their stack. No vendor lock-in. No opaque deliverability black boxes. Just a well-documented API sitting behind your AWS account.
The problem is not SES itself. It is everything you end up building around it.
Bounce handling requires an SNS topic, a Lambda function, and a persistence layer. Suppression lists need another Lambda and periodic cleanup logic. Analytics means CloudWatch metrics, a custom dashboard, and alerting rules. Warmup is a manual process of daily sending limit increases with rollback plans when bounce rates spike. Inbound email parsing requires Receipt Rules, S3 buckets, and more Lambda functions.
Most teams wire up SES in the first sprint and then spend the next two years maintaining email infrastructure instead of shipping product. That is the real cost.
What Transmit adds (and what it does not change)
Transmit's BYOK (Bring Your Own Keys) mode connects to your existing AWS credentials. It does not replace SES. It layers operational tooling on top of it.
What stays the same:
- Your AWS account and credentials
- Your SES sending costs ($0.10/1K emails)
- Your domains (already verified in SES)
- Your AWS billing relationship
- Your data stays in your AWS account for sending
What Transmit adds:
- Deliverability dashboards with bounce rates, complaint rates, and per-domain breakdowns
- Automated domain warmup with auto-pause on bounce spikes
- Bounce and complaint suppression (automatic, no Lambda functions required)
- Contact management and audience segmentation
- Email templates with Handlebars variables
- Sequences for automated drip campaigns
- Inbound email routing (receive, parse, forward, webhook)
- REST API and SMTP relay (same endpoint, simpler DX)
- MCP server for AI agent integration
BYOK: free to start
Connecting takes one of two paths:
- IAM Role (recommended): Use our one-click CloudFormation template to create a scoped IAM role. Transmit assumes the role via STS. No static credentials stored.
- Access Keys: Provide an IAM access key and secret. Encrypted with AES-256-GCM at rest.
The free tier includes 1,000 emails per month and 500 contacts. No credit card required.
Paid tiers start at $9/month and unlock higher sending limits, sequences, inbound routing, email validation, and more. Your SES costs do not change. The Transmit tier is the only additional cost.
Transmit calls SES on your behalf using your credentials. No email data is routed through Transmit's infrastructure for sending.
The real cost of raw SES
This is not about SES being expensive. At $0.10/1K, it is the cheapest option. The cost is engineering time.
| What you build | AWS services involved | Estimated time |
|---|---|---|
| Bounce handling | SNS topic, Lambda, DynamoDB | 2-3 days |
| Suppression lists | Lambda, S3, cleanup logic | 1-2 days |
| Analytics dashboard | CloudWatch, custom UI, alerting | 2-3 days |
| Domain warmup | Manual limits, daily increases, rollback | Ongoing |
| Inbound email parsing | Receipt Rules, S3, SNS, Lambda | 2-3 days |
| Template management | S3 or database, rendering logic | 1-2 days |
Total: 2-3 engineering weeks, plus ongoing maintenance.
With Transmit BYOK, you connect in 5 minutes and everything works out of the box. The Lambda functions, SNS topics, and DynamoDB tables you would have built are replaced by a single API integration.
How to connect in 5 minutes
Step 1: Create an IAM role
Use our CloudFormation template (one click) or create a role manually with the scoped permissions listed in our AWS setup guide.
Step 2: Connect in the Transmit dashboard
Paste the Role ARN into the onboarding flow. Transmit verifies the connection by calling sts:GetCallerIdentity on your behalf.
Step 3: Add your domains
Add your domains in the Transmit dashboard and verify with the same DNS records you already have in SES (DKIM, SPF, DMARC). If your DNS is already configured for SES, verification is near-instant.
Once connected, send your first email:
curl -X POST https://api.xmit.sh/email/send \
-H "Authorization: Bearer pm_live_xxxxx" \
-H "Content-Type: application/json" \
-d '{
"to": "user@example.com",
"from": "hello@yourapp.com",
"subject": "Welcome!",
"html": "<h1>You are all set.</h1>"
}'Full API reference: /docs/send-email
When managed mode makes more sense
BYOK is not for everyone. Transmit also offers a fully managed mode where we handle the entire AWS infrastructure. Managed mode is a better fit if:
- You do not have an AWS account and do not want to create one
- You want zero infrastructure management (no IAM roles, no credential rotation)
- You are sending fewer than 3,000 emails per month (managed starts at $2/mo for transactional)
- You want per-org reputation isolation without managing your own SES account
In managed mode, Transmit provisions isolated sending infrastructure for each organization. Your reputation is not affected by other customers on the platform.
For a detailed breakdown of both modes, see Managed vs BYOK.
The bottom line
SES is excellent infrastructure. Transmit does not replace it. BYOK mode adds the operational layer that SES does not ship: dashboards, automated warmup, suppression management, sequences, inbound routing, and a unified API.
If you are already on SES and tired of maintaining the glue code around it, connect your account in 5 minutes and get back to building your product.