Migrating from Mailgun to AWS SES: Step-by-Step Guide

Mailgun has long been the go-to for developers who want a clean REST API and minimal operational overhead. AWS SES is where teams land when they prioritize cost efficiency and AWS ecosystem consolidation over out-of-the-box simplicity. If your stack is already on AWS, the migration pays for itself quickly.

Why Teams Migrate from Mailgun to SES

Cost is the immediate trigger for most migrations. Mailgun’s pricing model has shifted over the years — the legacy free tier is gone, and the current Foundation plan carries a meaningful monthly fixed cost.

Mailgun Flex charges $0.80 per 1,000 emails with no monthly minimum — 8x the SES rate. Even the Foundation plan’s included 50,000 emails work out to $0.70 per 1,000 against SES’s $0.10.

API Migration: Mailgun → AWS SES

Mailgun’s Messages API and SES share the same conceptual model but use different request formats.

If your application uses SMTP, the migration is a credentials swap. Update the SMTP host to email-smtp.us-east-1.amazonaws.com (or your chosen region), generate SES SMTP credentials from the SES console, and update your application config. No code changes required.

Routing Rules: Mailgun Routes → SES Receipt Rules

Mailgun Routes allow you to match inbound email by recipient pattern or domain and forward, store, or call a webhook. SES Receipt Rules provide the same capabilities with deeper AWS integration.

Mailgun route (example):

match_recipient(".*@support.example.com")
→ forward("https://app.example.com/inbound")
→ store(notify="https://app.example.com/stored")

SES Receipt Rule equivalent:

1. Create a Rule Set in SES Receipt Rules
2. Add a rule matching @support.example.com
3. Set actions: Publish to SNS → Lambda function that calls your webhook endpoint

The SNS → Lambda pattern is more verbose to configure but gives you full programmatic control over inbound email routing, parsing, and processing. For teams comfortable with Lambda, it is the more powerful option.

EU Data Residency: Mailgun EU → SES eu-west-1

Mailgun offers a dedicated EU region (api.eu.mailgun.net) to keep email data within Europe for GDPR compliance. SES supports the same via region selection.

SES regions for EU data residency:

• eu-west-1 (Ireland) — primary EU region, lowest latency to EU users
• eu-central-1 (Frankfurt) — German data residency if required
• eu-west-2 (London) — UK data residency post-Brexit

Configure your SES SDK client to use the appropriate regional endpoint. DNS verification records (DKIM CNAME, MAIL FROM MX) must be added for each region separately — you cannot share verification between SES regions.

Webhook Event Format Mapping

Mailgun fires webhook POSTs to your endpoint for each email event. SES routes events through SNS, which then calls your HTTP endpoint (via SNS HTTP subscription) or Lambda.

The SNS message wrapper adds a layer around the SES event payload. Your handler needs to JSON-parse Message from the SNS envelope to get the SES event object.

Suppression List Migration

Mailgun maintains separate bounce, unsubscribe, and complaint lists per domain. SES has an account-level suppression list covering hard bounces and complaints across all domains.

Export from Mailgun:

GET /v3/{domain}/bounces      # Hard bounces
GET /v3/{domain}/unsubscribes # Unsubscribes
GET /v3/{domain}/complaints   # Spam complaints

Import to SES:

• Hard bounces and complaints → SES account-level suppression list (PutSuppressedDestination API, bulk via CSV import in console)
• Soft bounces → track in your application, do not import to SES suppression list
• Marketing unsubscribes → maintain in your application database; SES does not manage marketing opt-outs

Migration Steps

1. Verify your sending domain in SES (DKIM CNAME records + optional MAIL FROM MX)
2. Request SES production access if not already active (submit AWS support case)
3. Choose your region — use eu-west-1 or eu-central-1 if GDPR data residency applies
4. Create a Configuration Set with SNS event destinations for bounces, complaints, and deliveries
5. Implement SNS → Lambda event handler to process bounce and complaint notifications
6. Export Mailgun suppression lists and import hard bounces/complaints to SES suppression list
7. Update SMTP config or SDK calls to point at SES
8. If using inbound email: replicate Mailgun routes as SES Receipt Rules
9. Run parallel sends (Mailgun + SES) at low volume to validate deliverability and event handling
10. Gradually shift traffic to SES — cut over fully once SNS event pipeline is validated

Where Mailgun Still Wins

• Inbound email UI: Mailgun’s routing rule interface is more intuitive than SES Receipt Rules for non-AWS users
• Simpler onboarding: No AWS account setup, IAM policies, or VPC considerations — start sending in 15 minutes
• Log search: Mailgun’s log search UI for finding specific message events is faster than querying CloudWatch Logs
• EU simplicity: Switching to Mailgun EU is a one-line endpoint change; SES requires separate regional setup

When SES is the Clear Choice

SES is the right call when your stack is AWS-native, cost is a material concern, and your team has the AWS experience to operate SNS pipelines. The $30–$300+/month savings at typical transactional volumes pay back the migration effort within one to two billing cycles.

FactualMinds is an AWS Select Tier Consulting Partner. Our AWS SES consulting service covers the full Mailgun-to-SES migration: domain setup, Receipt Rule configuration, SNS event pipeline, suppression list import, and EU region compliance. Contact us to get started.