Amazon SES, set up with you by Claude.

You are helping me set up Amazon SES so I can send email from Meisa (meisa.io) through my own AWS account. Work in my browser, one step at a time. Before each step, tell me in one line what you are about to do. Stop and ask me whenever a choice is mine.

Rules:
- Never type passwords, payment details or access keys. If AWS asks me to sign in or add a card, hand over to me and wait.
- Never click Submit, Create access key or Delete without my OK.
- Use ONE AWS region for everything. Default: US East (N. Virginia), us-east-1, unless I name another.
- If something on screen does not match these steps, describe what you see and ask me.

First, ask me:
1. The domain I will send from (for example acme.com).
2. Who I email and how they opted in (for example: people who sign up for my app, newsletter subscribers who confirmed by email).
3. Roughly how many contacts I have and how often I send.
4. Where my DNS is managed (Cloudflare, Route 53, GoDaddy, Namecheap...).

Step 1. Verify my domain
- Open the SES console (console.aws.amazon.com/ses), check the region, go to Configuration > Identities > Create identity.
- Choose Domain, enter my domain, keep Easy DKIM with RSA 2048-bit.
- Turn on "Use a custom MAIL FROM domain" with mail.<my domain>, behaviour "Use default MAIL FROM domain" on failure.
- Create the identity. If my DNS is Route 53, let AWS publish the records. Otherwise list every record AWS shows (3 DKIM CNAMEs, the MAIL FROM MX and TXT) in a small table, then open my DNS provider in a new tab and add them with me. On Cloudflare, set every CNAME to "DNS only" (grey cloud).
- Check my domain has a DMARC record at _dmarc.<my domain>. If not, add TXT: v=DMARC1; p=none; rua=mailto:dmarc@<my domain>
- Wait until the identity shows Verified (often 5 to 30 minutes). Keep going meanwhile.

Step 2. Create a sending key for Meisa
- Open IAM > Users > Create user. Name: meisa-sender. No console access.
- Attach permissions directly > Create policy > JSON, paste the policy from meisa.io/guides/aws-ses-setup (section "IAM policy"), name it MeisaSending, and attach it to meisa-sender.
- Open the user > Security credentials > Create access key > "Application running outside AWS". Ask me before you click Create.
- When the keys appear, do NOT copy or type them anywhere. Tell me to open app.meisa.io > Email setup > Connect a provider > Amazon SES and paste the Access key ID and Secret access key myself, with region <the region we used>.

Step 3. Request production access
New SES accounts start in the sandbox: they can only send to verified addresses. Go to SES > Account dashboard > Request production access (or "Get set up" > Request production access). Fill it in:
- Mail type: Marketing if I send newsletters, otherwise Transactional.
- Website URL: my website.
- Use case description: write it from my answers using this outline, show it to me, and only submit after I approve:
  "We send [onboarding and product emails / a newsletter] to [who] who opted in by [how]. We have about [N] contacts and send about [frequency]. We send through Meisa (meisa.io), which: suppresses hard bounces and complaints automatically through an SES configuration set and SNS notifications; adds a one-click unsubscribe link and List-Unsubscribe headers to every marketing email; and supports double opt-in for new subscribers. We never send to purchased or rented lists. Our bounce rate target is under 2% and our complaint rate under 0.1%."
- Tick that I agree to the AWS Service Terms and Acceptable Use Policy only after I say yes.

Step 4. Finish in Meisa while AWS reviews (usually within 24 hours)
- In app.meisa.io > Email setup, on the Amazon SES provider, click "Set up delivery tracking". Meisa creates the configuration set and the SNS subscription for bounces and complaints itself.
- Send a test email to my own verified address.

If AWS replies asking for more detail, help me answer with specifics (how people opt in, a sample email, how unsubscribes work). If they decline, read the reason to me and draft a reply. Do not open a new case without asking me.

When everything is done, give me a short checklist of what is finished and what is still waiting on AWS.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "MeisaSend",
      "Effect": "Allow",
      "Action": [
        "ses:SendEmail",
        "ses:SendRawEmail",
        "ses:GetSendQuota",
        "ses:GetAccountSendingEnabled",
        "ses:ListIdentities",
        "ses:VerifyDomainIdentity",
        "ses:VerifyDomainDkim",
        "ses:GetIdentityVerificationAttributes",
        "ses:GetIdentityDkimAttributes",
        "ses:CreateConfigurationSet",
        "ses:DescribeConfigurationSet",
        "ses:CreateConfigurationSetEventDestination",
        "ses:UpdateConfigurationSetEventDestination"
      ],
      "Resource": "*"
    },
    {
      "Sid": "MeisaTracking",
      "Effect": "Allow",
      "Action": ["sns:CreateTopic", "sns:Subscribe", "sns:SetTopicAttributes"],
      "Resource": "*"
    }
  ]
}