SES email marketing, two models

Common ground

Both sides believe in SES economics

MailBluster deserves credit for taking SES economics further than almost anyone: unlimited subscribers, $60 a year, and a per-email fee measured in fractions of a cent. Against a mainstream ESP charging hundreds of dollars a month for the same list, it's not a close call — and that's the same argument we make. Both platforms send through SES in your own AWS account at AWS's ~$0.10 per 1,000; neither marks up delivery through shared infrastructure.

So the real comparison is everything around the sending: how the platform gets access to your SES account, who gets you through AWS's onboarding gates, and how much platform sits on top. For the broader picture of the first-party model, see how SendOps turns SES into an email operations platform — and if the self-hosted route is also on your list, the SendOps vs Sendy comparison covers it.

Domain authentication

The missing layer: who else is sending as your domain?

MailBluster generates and verifies a DMARC record when you set up a sender domain, which is more than many low-cost tools bother with. Publishing that record is where domain authentication begins, though, not where it ends. The record asks mailbox providers to send reports; somebody still has to read them.

MailBluster reports on the campaigns you send through MailBluster, and SendOps reports on the broadcasts and workflows you send through SendOps. Neither view covers the billing system, the CRM, the helpdesk, or the forgotten SaaS tool that also puts your domain in the visible From address. Domain-based Message Authentication, Reporting, and Conformance (DMARC) aggregate reports are what make those senders visible.

SendOps receives those reports for the exact domain in your visible From address, groups the raw records into recognizable sources, and diagnoses why SPF or DKIM failed to align. Because SendOps operates your SES identities and knows your DKIM selectors, it can prove which sources are your own sending. That separates a first-party misconfiguration from traffic nobody has identified yet.

An unidentified source is a question to answer, not automatically an attacker — it is often a shared sending pool, an old vendor, or ordinary forwarding. Rejecting a source records that it is not yours. It does not block the source or silence future alerts. A stricter DMARC policy is what asks receiving providers to act on unauthenticated mail.

When the evidence supports moving from p=none toward quarantine or reject, SendOps shows the expected impact, the exact record diff, and a watch window, then keeps a rollback record. SendOps recommends the change and you publish it in your own DNS provider. The scope is the exact domain in the visible From address, so lookalike registrations such as example-payments.com stay outside what these reports can show.

SendOps accepts aggregate rua reports and deliberately declines forensic ruf reports, which can carry recipient addresses, subject lines, and message content. The whole workflow is on the DMARC monitoring page, and the help center covers setting up DMARC reporting. The same layer shows up in the BigMailer and EmailOctopus comparisons.

The credentials question

Pasted keys vs a role you can revoke

MailBluster connects the way most of the BYO-SES category does: you generate SES credentials in AWS and paste them into the app, which stores them and sends on your behalf. That's convenient and industry-common — it works, and it's a big part of why setup takes minutes.

The trade-off is structural: long-lived credentials held by a vendor are a bigger blast radius than a scoped role in your own account. They live in someone else's database, they stay valid until rotated, and revoking them is a manual chore on your side. SendOps connects differently: a CloudFormation stack provisions a scoped IAM role in your AWS account, and access happens through short-lived STS role assumption. Nothing is pasted, nothing is stored, every action is auditable in CloudTrail — and ending the relationship is deleting one stack.

Onboarding follows the same pattern. New SES accounts start in the sandbox, and MailBluster leaves the production-access request entirely to you — it's the step users most often report getting stuck on. SendOps automates that request as part of setup. If you're doing it by hand either way, our Amazon SES setup guide covers the sandbox exit step by step.

The platform-depth question

Least cost vs most platform

MailBluster optimizes for one thing and says so: least cost. You get a drag-and-drop editor (with quirks users commonly note), segmentation, and drip automation — enough to run campaigns, priced so low it's hard to complain. But the drag-and-drop medium has a ceiling: what you build in it is editor state in their app, so there is no file for version control or for coding agents to read. Analytics stay at the campaign level: opens, clicks, per-send stats.

SendOps optimizes for depth on the same economics. SendQL queries contacts, events, and send activity for segmentation beyond field rules. SendFlow builds multi-step behavioral workflows — event triggers, branches, frequency caps — in a text DSL with a visual canvas, and a workflow run's email can be previewed as rendered before the workflow sends it. Templates are React Email components in git, compiled to SES-native Handlebars with an asset CDN, so email designs get code review instead of living only in an in-app editor. Analytics go past campaigns to deliverability itself — bounce and complaint trends with alerts before SES's reputation thresholds become an account-level problem.

Because those definitions are text, an agent can author a SendQL segment, a SendFlow workflow, or a template and open a pull request against your repository. SendOps validates the change, a person merges it, and nothing is live until the merge is synced.

Live data and operations run through a first-party MCP server and an OAuth 2.1 Public API, so an agent can inspect audiences, prepare a broadcast, or review DMARC posture without a copied long-lived key. Sending a broadcast and activating a workflow each require an explicit confirmation after the impact is shown. An agent cannot merge the pull request, publish DNS, or advance a DMARC policy.

The pricing shape

Per-email vs flat — and where they cross

MailBluster is $60 per year per brand plus $0.60 per 1,000 emails sent through the platform, with a one-time free tier of 3,000 branded emails and unlimited subscribers (list prices as of July 2026). AWS bills its ~$0.10 per 1,000 on top, so all-in delivery runs about $0.70 per 1,000. That is absurdly cheap by ESP standards — and worth noting honestly: the platform fee is still six times the price of the underlying SES delivery.

SendOps charges no per-email platform fee: Free at $0 with unmetered volume and no contact limits, Team at $29/mo, Business at $149/mo, with SES's ~$0.10 per 1,000 going straight to AWS. The crossover is easy math: at 100,000 emails a month, MailBluster's per-email fee alone is about $60/mo — more than a Team plan — while SendOps Free stays at $0 at any volume. At very low volume with paid-tier features in play, MailBluster's $60/year can beat $29/mo; below that, SendOps Free wins outright. Full delivery-cost math is in the Amazon SES pricing breakdown.