Two ways to run email marketing on your own Amazon SES

Common ground

Both sides believe in SES economics

Let's start with what BigMailer gets right, because it's the same thing we bet the company on: Amazon SES is the best-priced delivery infrastructure in email — about $0.10 per 1,000 messages — and the smart move is a proper marketing layer on top of it rather than a conventional ESP's bundled markup. BigMailer has been making that case for years, with a particular focus on agencies running many brands. We respect it; it's a good product built on the right premise.

The comparison, then, isn't about whether SES is the right foundation — it's about the two decisions layered on top: how the platform gets access to your SES account, and how much platform you get. For the full picture of how SendOps approaches the first-party model, see how SendOps turns SES into an email operations platform. If you're also weighing the self-hosted route, the SendOps vs Sendy comparison covers that corner of the map.

Domain authentication

The missing layer: who else is sending as your domain?

BigMailer reports on the campaigns you send through BigMailer, and SendOps reports on the broadcasts and workflows you send through SendOps. Neither view covers the billing system, the CRM, the helpdesk, or the forgotten SaaS tool that also puts your domain in the visible From address. That traffic still shapes how mailbox providers judge your domain.

Domain-based Message Authentication, Reporting, and Conformance (DMARC) is what closes the gap. Mailbox providers send aggregate reports describing every source that sent as your domain, not only the mail that went through SES. SendOps receives those reports for the exact domain in your visible From address, groups the raw records into recognizable sources, and diagnoses why SPF or DKIM failed to align.

Because SendOps operates your SES identities and knows your DKIM selectors, it can prove which of those sources is your own sending. That is what separates a first-party misconfiguration from traffic nobody has identified yet. An unidentified source is a question to answer, not automatically an attacker — it is often a shared sending pool, an old vendor, or ordinary forwarding.

Reviewing a source records a decision; it does not change what receivers do. Rejecting a source records that it is not yours. It does not block the source or silence future alerts. A stricter DMARC policy is what asks receiving providers to act on unauthenticated mail.

When the evidence supports moving from p=none toward quarantine or reject, SendOps shows the expected impact, the exact record diff, and a watch window, then keeps a rollback record. SendOps recommends the change and you publish it in your own DNS provider. The scope is the exact domain in the visible From address, so lookalike registrations such as example-payments.com stay outside what these reports can show.

SendOps accepts aggregate rua reports and deliberately declines forensic ruf reports, which can carry recipient addresses, subject lines, and message content. The whole workflow is on the DMARC monitoring page, and the help center covers setting up DMARC reporting. The same layer shows up in the MailBluster and EmailOctopus comparisons.

The credentials question

Pasted keys vs a role you can revoke

BigMailer connects to your SES account the way most BYO-SES tools do: you create credentials in AWS, paste them into BigMailer, and it stores them to send on your behalf. To be fair, this is convenient and industry-common — it takes minutes, and BigMailer is a reputable company that handles it professionally.

But long-lived credentials a vendor stores are, structurally, a bigger blast radius than a scoped role in your own account. They sit in someone else's database. They keep working until someone remembers to rotate them. If they're ever exposed — on either side of the relationship — they're valid until revoked. SendOps takes the other path: a CloudFormation stack provisions a scoped IAM role in your account, access happens through short-lived STS role assumption, and no key is ever pasted or stored anywhere. You can read exactly what the role permits, watch what it does in CloudTrail, and end the relationship completely by deleting one stack.

The same onboarding difference shows up before you send a single email. New SES accounts start in the sandbox, and BigMailer — like most of the category — leaves the production-access request to you. SendOps automates it as part of setup. If you're starting SES from zero either way, our Amazon SES setup guide walks through the whole path, including the sandbox exit.

The platform-depth question

Campaign tool vs full platform

BigMailer is deliberately focused: drag-and-drop and HTML editors, solid segmentation, RSS-to-email, automation flows, and — its real differentiator — multi-brand management that lets an agency keep every client's lists, campaigns, and branding cleanly separated under one account. For simple campaigns across many brands, that focus is a feature. The tradeoff is the medium itself: a drag-and-drop editor is built for a human with a mouse, and its output is editor state rather than reviewable text, so coding agents have nothing to read, diff, or maintain.

SendOps goes deeper on the marketing machinery itself. SendQL is a query language over contacts, events, and send activity — segments that go beyond field-matching rules. SendFlow builds multi-step drip and behavioral workflows with event triggers, branching, and frequency caps, defined in a text DSL with a visual canvas — and a workflow run's email can be previewed as rendered before the workflow sends it. Templates are React Email components in git, compiled to SES-native Handlebars with an asset CDN, so email gets code review like everything else you ship.

Because those definitions are text, an agent can author a SendQL segment, a SendFlow workflow, or a template and open a pull request against your repository. SendOps validates the change, a person merges it, and nothing is live until the merge is synced.

Live data and operations run through a first-party MCP server and an OAuth 2.1 Public API, so an agent can inspect audiences, prepare a broadcast, or review DMARC posture without a copied long-lived key. Sending a broadcast and activating a workflow each require an explicit confirmation after the impact is shown. An agent cannot merge the pull request, publish DNS, or advance a DMARC policy.

Analytics follow the same split: BigMailer reports on campaigns; SendOps adds deliverability analytics — bounce, complaint, and engagement trends across broadcasts and workflows — with alerts that fire before SES's reputation thresholds become a problem.

The pricing shape

Per-contact vs flat

BigMailer prices per contact: Business Lite at $7.50 per 5,000 contacts per month plus $0.10 per 1,000 emails for the SES connection, Business Pro at $15 per 5,000 with managed sending (around a $60/mo minimum), and Agency Pro at $12 per 5,000 — list prices as of July 2026, following increases announced in March 2026 that also moved overage sending to $0.75 per 1,000. At 10,000 contacts that's genuinely cheap. At 100,000 contacts, Lite works out to roughly $150/mo before sending — the meter runs on list size, whether or not you email everyone.

SendOps is flat: Free at $0 with unmetered volume and no contact limits, Team at $29/mo, Business at $149/mo. The only per-unit cost is SES itself, billed by AWS at about $0.10 per 1,000 emails on both platforms. Small list, simple needs? BigMailer's entry price is lower than our paid tiers (though not lower than Free). Growing list? The flat shape wins, and keeps winning. For the raw delivery math, see the Amazon SES pricing breakdown.