Receive with SES and S3. Send with SMTP or Resend.

Before you start

You'll need:

• A domain whose DNS you can edit, for example example.com.
• An AWS account, in a Region where Amazon SES email receiving is available. Check the SES documentation for the current list of Regions.
• For sending: an SMTP server (Amazon SES SMTP, Resend or any other provider), or a Resend API key.

1. Verify your domain in SES

1. In the Amazon SES console, open Configuration → Identities and create a domain identity for example.com. Add the DKIM records it gives you to your DNS.
2. Point your domain's mail at SES by adding an MX record:

   Type	Name	Priority	Value
   MX	example.com	10	inbound-smtp.us-east-1.amazonaws.com

   Replace us-east-1 with the Region where you set up receiving.

2. Create the S3 bucket

Create a private S3 bucket (keep Block all public access on), for example my-mail-bucket. It can be in any Region, because Bucketmail detects the bucket's Region automatically. Then add a bucket policy that lets SES write to it:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowSESPuts",
      "Effect": "Allow",
      "Principal": { "Service": "ses.amazonaws.com" },
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::my-mail-bucket/*",
      "Condition": {
        "StringEquals": { "AWS:SourceAccount": "111122223333" },
        "StringLike":   { "AWS:SourceArn": "arn:aws:ses:*" }
      }
    }
  ]
}

Replace my-mail-bucket with your bucket name and 111122223333 with your AWS account ID.

Default bucket encryption with S3-managed keys (SSE-S3) needs no extra setup. If you use SSE-KMS, the IAM user in step 4 also needs kms:Decrypt on that key.

3. Create an SES receipt rule

1. In SES, open Configuration → Email receiving, create a rule set and make it active.
2. Add a rule. Under Recipient conditions, enter the addresses (or the whole domain) the rule applies to, such as support@example.com.
3. Add the action Deliver to Amazon S3 bucket:
   • S3 bucket: my-mail-bucket
   • Object key prefix: one prefix per mailbox, for example support/inbox/
   • Leave message encryption off. SES client-side encryption produces objects Bucketmail can't read.
4. Save the rule and send a test email to the address. A new object should appear under the prefix within a few seconds.

4. Give Bucketmail read-only access (IAM)

Create an IAM user just for Bucketmail and attach this policy. It needs only two permissions, s3:ListBucket and s3:GetObject:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ListMail",
      "Effect": "Allow",
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::my-mail-bucket"
    },
    {
      "Sid": "ReadMail",
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-mail-bucket/*"
    }
  ]
}

Then create an access key for the user (use case: Application running outside AWS). Keep the Access Key ID and Secret Access Key for the next step.

To limit the user to certain mailboxes, narrow s3:GetObject to arn:aws:s3:::my-mail-bucket/support/*. You can also add an s3:prefix condition to s3:ListBucket.

5. Configure Bucketmail

Open Setup: choose Bucketmail → Settings… (⌘,) on the Mac, or tap the gear button in the mailbox list on iPhone and iPad.

Amazon S3 — Receiving

1. Enter the Access Key ID, Secret Access Key and Default Region, for example us-east-1.
2. Tap Save to Keychain. Your keys are stored in the Keychain on this device, never in a file.
3. After you add accounts, use Test Buckets to confirm Bucketmail can list each bucket. If the Region is wrong, Bucketmail corrects it automatically.

Add an account

6. Sending: SMTP or Resend

Under Sending, choose Send Using for each account. Then use Send Test Email, which sends a message to the account's own address.

SMTP

Port 465 uses TLS from the start (implicit TLS). Port 587 connects and then upgrades with STARTTLS. Bucketmail authenticates with AUTH PLAIN or LOGIN.

With Amazon SES, the From address (or its domain) must be a verified identity. New SES accounts start in the sandbox and can send only to verified addresses until you request production access.

Resend API

Choose Resend API and paste a Resend API key. Bucketmail sends over HTTPS to api.resend.com. The From address's domain must be verified in Resend.

7. Checking for mail

• Get Mail: the download button in the toolbar, pull to refresh on iPhone and iPad, or ⇧⌘N on the Mac.
• Check for mail at launch and Check automatically (every 5, 15 or 30 minutes, or every hour) are in Setup under Fetching.
• Only new objects are downloaded. Messages are stored on your device under the app's Application Support folder. On the Mac, Setup → Storage → Show in Finder takes you there.

Importing a config.json

If you already have a JSON configuration for your mailboxes, use Setup → Import config.json… to add every account at once. Passwords, API keys and AWS keys go straight into the Keychain.

{
  "support": {
    "bucket_name": "my-mail-bucket",
    "prefix": "support/inbox/",
    "from_email": "support@example.com",
    "sender_name": "Support",
    "send_method": "smtp",
    "smtp_server": "smtp.resend.com",
    "smtp_port": 465,
    "smtp_username": "resend",
    "smtp_password": "re_xxxxxxxx"
  },
  "_aws": {
    "aws_access_key_id": "AKIA…",
    "aws_secret_access_key": "…",
    "aws_region": "us-east-1"
  }
}

Once the import has finished, delete the file from wherever you shared it, since it contains secrets.

Troubleshooting

Still stuck? See Support.