# KumoMTA on AWS — Reference Templates

Reference policy, DNS, and observability templates for the FactualMinds guide [How to Set Up KumoMTA on AWS for Production](/blog/kumomta-production-setup-aws-enterprise-guide/).

## Prerequisites

- Dedicated EC2 instance (KumoMTA recommends **4+ vCPUs** and **16+ GiB RAM** per [server environment docs](https://docs.kumomta.com/userguide/installation/environment/))
- AWS outbound **port 25** restriction removed if sending directly to recipient MX servers ([EC2 email throttling](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-resource-limits.html))
- Route53 hosted zone for your sending domain
- Elastic IP with PTR (reverse DNS) aligned to SMTP HELO hostname

## Quick start

```bash
# 1. Copy policy skeleton to your instance
sudo mkdir -p /opt/kumomta/etc/policy
sudo cp policy/init.lua.example /opt/kumomta/etc/policy/init.lua

# 2. Edit hostnames, relay CIDRs, and IP pool names for your VPC
sudo vim /opt/kumomta/etc/policy/init.lua

# 3. Publish DNS records (replace example.com and IPs)
# See dns/route53-records.example.txt

# 4. Install CloudWatch agent config
sudo cp observability/cloudwatch-agent.json /opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.json
sudo systemctl restart amazon-cloudwatch-agent
```

## Contents

| Path | Purpose |
|------|---------|
| `policy/init.lua.example` | Listener, queue, and IP pool policy skeleton |
| `dns/route53-records.example.txt` | SPF, DKIM, DMARC, MAIL FROM, and A record templates |
| `observability/cloudwatch-agent.json` | Log and host metric collection baseline |
| `production-readiness-checklist.md` | Condensed go-live checklist |

## Related documentation

- [KumoMTA Linux installation](https://docs.kumomta.com/userguide/installation/linux/)
- [KumoMTA traffic shaping](https://docs.kumomta.com/userguide/configuration/trafficshaping/)
- [AWS SES consulting](https://www.factualminds.com/services/aws-ses/) (hybrid relay / migration path)