farmerswife Email Delivery (AWS SES)

Overview

farmerswife uses Amazon Simple Email Service (Amazon SES), a managed cloud-based email delivery service provided by Amazon Web Services (AWS), to send system-generated emails such as notifications, alerts, and transactional messages.

This solution is designed to ensure:

• reliable and scalable email delivery

• strong authentication and protection against spoofing

• secure handling of email data

• visibility into delivery performance and issues

Hosting & Infrastructure

Amazon SES is a fully managed service hosted within AWS infrastructure. This means:

• AWS operates and secures the underlying systems, network, and data centers

• farmerswife configures and manages how the service is used

Key points:

• High availability and redundancy are handled by AWS

• farmerswife does not operate or access the underlying mail servers directly

Security

Shared Responsibility Model

Security follows the AWS shared responsibility model:

• AWS is responsible for:

  • physical data center security

  • infrastructure and network protection

  • managed service availability

• farmerswife is responsible for:

  • secure configuration of SES

  • access control and permissions

  • domain authentication (SPF, DKIM, DMARC)

  • monitoring and operational security

Access Control

Access to the email system is controlled using AWS Identity and Access Management (IAM):

• permissions follow the principle of least privilege

• only authorized services and roles can send email

• credentials are restricted and regularly reviewed

Encryption

• In transit:
  All communication with Amazon SES uses TLS encryption (HTTPS or SMTP with STARTTLS)

• At rest:
  Data within SES is encrypted at rest using AWS-managed encryption mechanisms

• Delivery to recipients:
  Emails are sent using opportunistic TLS, meaning encryption is used whenever supported by the receiving server

Email Authentication (SPF, DKIM, DMARC)

To ensure authenticity and protect against spoofing and phishing, farmerswife implements industry-standard email authentication mechanisms.

DKIM (DomainKeys Identified Mail)

• All outgoing emails are cryptographically signed

• Allows recipient servers to verify that messages:

  • were authorized by the sending domain

  • were not altered in transit

SPF (Sender Policy Framework)

• DNS records define which servers are allowed to send email on behalf of the domain

• Prevents unauthorized systems from impersonating farmerswife domains

DMARC (Domain-based Message Authentication, Reporting & Conformance)

• Builds on SPF and DKIM to enforce domain-level policies

• Enables:

  • alignment checks

  • reporting on authentication results

  • protection against spoofed emails

Typical policy approach:

• Monitoring mode → gradual enforcement → full protection (reject policy)

Data Handling

What data is processed

When sending emails, the system may process:

• recipient email addresses

• message metadata (e.g., timestamps, delivery status)

• email content (only as required to deliver the message)

• delivery events (e.g., bounce, complaint, delivery status)

Event Monitoring

farmerswife may use AWS event publishing to monitor:

• successful deliveries

• bounces

• spam complaints

This helps maintain delivery quality and quickly identify issues.

Data Minimization

• Only data necessary for email delivery and monitoring is processed

• No unnecessary retention of email content

• Access to logs and events is restricted to authorized personnel

Reliability & Deliverability

Amazon SES provides:

• high delivery reliability through AWS global infrastructure

• scalable throughput for varying email volumes

• reputation monitoring via bounce and complaint tracking

farmerswife actively monitors:

• delivery success rates

• bounce rates

• complaint rates

tTo ensure optimal deliverability and maintain sender reputation.

Compliance & Best Practices

The solution aligns with industry best practices, including:

• use of authenticated sending domains

• DNS-based anti-spoofing protections (SPF, DKIM, DMARC)

• secure transport encryption (TLS)

• least-privilege access control

• monitoring and alerting on delivery events