AWS SES domain & deliverability setup

Part A — Choose region and request production access

1. 1Open AWS Console → switch to your target region (e.g. US East (N. Virginia) us-east-1).
2. 2Go to Amazon SES → Account dashboard.
3. 3If status shows Sandbox, click Request production access.
   • Mail type: Transactional
   • Use case: Customer support email for SaaS platform
   • Approval typically within 24–48 hours

   Expected result

   In sandbox you can only send to verified addresses. Agents cannot go live until production access is granted.

Part B — Verify inbound domain (receive mail)

4. 4SES → Verified identities → Create identity → type Domain.
5. 5Enter inbound subdomain: e.g. inbound.example.com → Create.
6. 6Copy DNS records SES shows (DKIM CNAMEs + verification TXT) → publish in your DNS provider.
7. 7Add MX record for inbound subdomain:

   Host: inbound.example.com
   Type: MX
   Priority: 10
   Value: inbound-smtp.us-east-1.amazonaws.com

   Expected result

   SES identity status becomes Verified (may take up to 72 hours for DNS).

Part C — Receipt rule set (route inbound mail to Fiko)

SES receives mail via MX → the receipt rule decides where to store the raw MIME and how to notify Fiko. Fiko reads the email from S3 (or from SNS inline payload if the message is small).

8. 8SES → Email receiving → Rule sets → Create rule set.
   • Rule set name: fiko-inbound
   • Click Create
9. 9Select the new rule set → Set as active rule set.

   Expected result

   Only one active rule set per region. Deactivate the old rule set first if needed.
10. 10Inside the rule set → Create rule. Fill each field below:

11. 11Create S3 bucket (if not exists): S3 → Create bucket → name fiko-ses-inbound-prod → same region as SES.
    • Block public access: ON (private bucket)
    • Versioning: optional
    • Lifecycle: optional — delete objects after 90 days to save cost
12. 12Create SNS topic: SNS → Topics → Create topic → name fiko-ses-inbound-notify → Standard.
13. 13Subscribe topic to Fiko webhook:
    • Topic → Create subscription
    • Protocol: HTTPS
    • Endpoint: https://msg.fikosrv.com/v2/email/ses/inbound
    • Enable raw message delivery: OFF (Fiko verifies SNS signature on JSON envelope)

    Expected result

    SNS sends SubscriptionConfirmation — Fiko auto-confirms via SubscribeURL. Check messaging-service log: SES SNS subscription confirmed.
14. 14(Optional) Bounce/complaint events — separate topic subscribed to:

    https://msg.fikosrv.com/v2/email/ses/events

    Configure in SES → Configuration sets or identity notifications.
15. 15Save receipt rule → send test email to [email protected] → verify:
    • S3 bucket has a new .eml object
    • SNS topic shows successful delivery to Fiko endpoint
    • CloudWatch / messaging-service log shows no Invalid SNS signature errors

Part D — Verify reply domain (send mail)

16. 16SES → Verified identities → Create identity → Domain → reply.example.com.
17. 17Enable Easy DKIM → publish the 3 CNAME records SES provides.
18. 18Configure Custom MAIL FROM domain:
    • MAIL FROM: e.g. bounce.reply.example.com
    • Publish MX + SPF records SES provides for MAIL FROM subdomain
19. 19Add SPF on reply domain:

    Host: reply.example.com
    Type: TXT
    Value: v=spf1 include:amazonses.com ~all

20. 20Add DMARC (start monitoring):

    Host: _dmarc.reply.example.com
    Type: TXT
    Value: v=DMARC1; p=none; rua=mailto:[email protected]

Part E — IAM user for Fiko

21. 21IAM → Users → Create user → name fiko-email-ses → do not enable console access.
22. 22Attach inline policy (replace bucket name if different):

    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Sid": "SesSend",
          "Effect": "Allow",
          "Action": ["ses:SendRawEmail", "ses:SendEmail"],
          "Resource": "*"
        },
        {
          "Sid": "SesInboundS3Read",
          "Effect": "Allow",
          "Action": ["s3:GetObject"],
          "Resource": "arn:aws:s3:::fiko-ses-inbound-prod/*"
        }
      ]
    }

    Expected result

    Use a dedicated fiko-email-ses user — do not reuse PRIVATE_AWS_* (company file-upload S3 keys).
23. 23Security credentials → Create access key → Use case: Application running outside AWS → copy Access key ID + Secret.

Part F — Environment variables

24. 24On fiko-messaging-service:

    EMAIL_SES_ACCESS_KEY_ID=AKIA...
    EMAIL_SES_SECRET_ACCESS_KEY=...
    AWS_SES_REGION=us-east-1
    EMAIL_INBOUND_DOMAIN=inbound.example.com
    EMAIL_REPLY_DOMAIN=reply.example.com

25. 25On fiko-core-service (validates inbound address when agent creates forwarding channel):

    EMAIL_INBOUND_DOMAIN=inbound.example.com

26. 26Redeploy / restart messaging-service and core-service after updating env.

Part G — Verify end-to-end

27. 27In Fiko → Apps → Email → Add new → Any email (forwarding).
28. 28Enter support address → Fiko generates inbound address like support-{token}@inbound.example.com.
29. 29Configure forwarding on the mail server → Test configuration → Connect.
30. 30Complete test configuration → create channel → send test email.

    Expected result

    Chat appears in Fiko; reply sends from @reply.example.com with spf=pass, dkim=pass in Gmail "Show original".