# Postal v3 on AWS — Production Readiness Checklist (Condensed)

Use before routing production traffic. Full checklist in the [enterprise guide](/blog/postal-v3-production-setup-aws-enterprise-guide/).

## Platform

- [ ] Postal v3 install helper cloned to `/opt/postal/install`
- [ ] `postal bootstrap` completed for production hostname
- [ ] `postal initialize` and admin user created
- [ ] `postal start` — web, smtp, worker containers healthy (`postal status`)
- [ ] Caddy running with valid TLS for web hostname

## Database

- [ ] Amazon RDS MariaDB 10.6+ (not dev Docker MariaDB with default password)
- [ ] `innodb_log_file_size` sized for max message (Postal: 10× largest message)
- [ ] Automated RDS backups and Multi-AZ enabled for production

## DNS and deliverability

- [ ] A record + PTR for `postal.example.com`
- [ ] SPF include, return-path, route, and track domains published
- [ ] DKIM from `postal default-dkim-record` applied to return-path domain
- [ ] Customer domains verified in Postal virtual mail server UI

## AWS security

- [ ] Port 25 outbound restriction removed (if direct MX delivery)
- [ ] SSM Session Manager enabled; SSH restricted
- [ ] Secrets in Secrets Manager (DB passwords, not plaintext in repo)
- [ ] Security groups: 443/80 (Caddy), 25/587 (SMTP), no unnecessary inbound

## Observability

- [ ] CloudWatch agent shipping host and Docker logs
- [ ] Alarms on CPU, disk, RDS connections, SMTP errors
- [ ] Synthetic API send probe scheduled