I'll be using email addresses on the domain I registered through Route 53.
Amazon Work Mail.
With domestic hosting services, once you register a domain, the admin panel typically includes a built-in function for issuing email accounts. Now that I'm using AWS — with my domain registered through Route 53 and configured for my website — I can't find any equivalent function for issuing email accounts.
I go looking to see if there's a dedicated email instance of some kind. Searching the AWS Management Console for "Mail" turns up Amazon WorkMail, which is what this article covers.
Managed Services.
Amazon WorkMail is a managed service rather than an instance. In terms of features, it's comparable to Gmail in Google Workspace or Outlook in Microsoft 365. What Google and Microsoft have in common is that both manage organizations by domain, which makes it easy to issue email accounts.
Pricing is per account — you pay a usage fee for each email account. // Email accounts can also use aliases: each account can have up to 30 aliases. Beyond email, there are various features including business apps and storage, and if you think of it as cloud-based business software for a company, the service makes a lot of sense.
As a side note, Google Workspace comes with a rich set of features. Sync it with an Android device like a Pixel and it goes well beyond business software — employees can clock in and out by logging in and out at the start and end of the workday, company buildings, floors, and rooms can be set up as workspaces, and meeting rooms can be booked and managed, all through the cloud.
Amazon WorkMail is the same kind of service. The difference is that it doesn't include business apps like spreadsheets or a generous amount of storage. It's a simpler offering — email and calendar only, with 50 GB of storage — at $4/month.
AWS is primarily used by large enterprises. Amazon WorkMail follows the same pattern: you create an Organization, associate a domain with it, and then set up a User for each email account you need.
1. Setting Up Amazon WorkMail.
Let's go ahead and set up Amazon WorkMail.
The admin panel — in AWS terms, this is called the Management Console. This is actually the first time I've come across the official name, so I'll use Management Console from here on. The first step is to select the region for WorkMail.
- Log in to the Management Console with the execution user account.
- Enter "WorkMail" in the search bar. This brings up the WorkMail console.
- Select the region. WorkMail is available in three regions: US East (N. Virginia), US West (Oregon), and EU (Ireland). I select Oregon as the closest to Japan.
That's all it takes to get WorkMail ready.
The WorkMail interface is entirely in English. Before configuring anything, it helps to understand how WorkMail is structured.
- Set up an Organization and assign a domain to it
- Assign groups to the Organization
- Register users to assign to the groups
- Grant email accounts to the users assigned to the groups
- The user accounts with email accounts assigned to them can then use email
This structure is the same as Google Workspace and Microsoft 365 — you manage an organization by domain, then grant email accounts to users belonging to that organization.
I'll start with the Organization setup.
Click [Create Organization]. The Organization settings screen shown below opens. Since the region is Oregon, the interface is in English. Fill in the required fields.
2. Organization Setup.
Create an Amazon WorkMail organization
Create an Amazon WorkMail organization to provide email addresses to groups of users in your company. The email addresses include the domains that you select for your organization.
Organization settings
Email domain Info
Select the domain to use for email addresses in your organization.
[1] Existing Route 53 domain { // Select this option, as we're assigning the domain registered in Route 53. }
// Select a domain name that you manage with a Route 53 hosted zone.
[2] New Route 53 domain
// Register a new Route 53 domain name to use with Amazon WorkMail.
[3]External domain
// Enter a domain name that you manage with an external DNS provider.
[4]Free test domain
// Use a free testing domain provided by Amazon WorkMail. You can add a domain later.
Route 53 hosted zone
Select the Route 53 hosted zone to use for your organization.
{ // Enter the domain you registered here. e.g. // my-domain.com // }
Email addresses appear as: janedoe@my-domain.com
Alias Info
Enter the alias to use for your organization.
{ Enter a name that identifies your domain. e.g. // my-domain // }
Your alias can have up to 45 characters. Aliases can only include lowercase letters (a-z), numbers (0-9), and dashes (-).
This determines the login URL for the web application: [alias].awsapps.com/mail
User directory Info
Select the directory where you manage your users.
[1] Create Amazon WorkMail directory { // Select this option, as we're assigning the domain registered in Route 53. }
// Create a directory and add your users to it. This directory is only for WorkMail and cannot be used with other AWS services or applications.
[2] Use existing directory
// Use an existing directory to manage your users, such as an Active Directory.
EncryptionInfo
Select an encryption key to help secure your data. Encryption keys are in AWS Key Management Service (AWS KMS) in your account.
[1] Use Amazon WorkMail managed key { // Select this option, as we're assigning the domain registered in Route 53. }
// Use the encryption key that we create in your account.
[2] Use existing customer managed key (CMK)
Use an existing CMK you created in AWS KMS.
Cancel / Create organization { // Click Create organization }
3. Assigning the Domain.
The Organization registration is complete, but at this point the domain hasn't been assigned yet. I'll now proceed with assigning the domain. To use email on a specific domain, you need to register authentication records with the DNS server.
Once the Organization is registered, the WorkMail console displays something like:
my-domain
Organization ID
m-Ccsfara537889876676
Default domain
my-domain.com
State
Active
The Organization is displayed in this form. The name set as the Organization alias carries a link — click it.
The left-hand menu shows:
- Organizations
- What's new
- Organization
- Users
- Groups
- Resources
- Domains
- Mobile policies
- Organization settings
- Tags
- Access control rules
- Retention policies
- Impersonation roles
- Monitoring
- Logging settings
- Amazon Simple Email Service
Select "Domains" from the menu and configure the settings. The screen below appears.
3-1. Assigning a Domain to WorkMail.
Domains / Add domain
Domain / Domain status / Default domain
my-domain.awsapps.com / Verified / Default
my-domain.com { Clicking Add domain to add a domain will display it here. }
Click Add domain to register the domain. A popup opens — enter my-domain.com.
Click the domain you just added.
3-2. Checking the DNS Records.
my-domain.com
Domain ownership Info
> Domain ownership details
WorkMail configuration Info
> WorkMail configuration details
Improved security - recommended Info
> Improved security details
Improved email delivery - recommended Info
> Improved email delivery details
The above screen opens.
> Domain ownership details
> WorkMail configuration details
> Improved security details
> Improved email delivery details
Clicking the arrow dropdown reveals the configured records. The records shown below are for WorkMail configuration.
3-3. Writing Records to DNS.
WorkMail configuration details
Type / Record name / Value / Status
MX my-domain.com. 10 inbound-smtp.us-west-2.amazonaws.com. / Verified
CNAME autodiscover.my-domain.com. autodiscover.mail.us-west-2.awsapps.com. / Verified
Write all the records shown here into the DNS.
Write all records from > Domain ownership details, > WorkMail configuration details, > Improved security details, and > Improved email delivery details into the DNS.
Once the records are written to DNS and the settings are correct, the status for each record changes to "Verified." Write all records into the DNS.
3-4. Adding Records to the Lightsail DNS.
If using EC2, you'd write the records into Route 53's DNS. Since I'm using Lightsail's DNS, I open the Lightsail console, select "Domains and DNS," choose "Add record," select the record type (MX, TXT, or CNAME), and enter the value.
※ Route 53 allows all text data to be copied and pasted at once, but Lightsail's DNS requires entries to be made one at a time.
Once all records are Verified, email becomes available.
This completes the Organization setup. With this configuration, the domain is assigned to the Organization, and it's now ready to grant email accounts on that domain to users belonging to the Organization.
3-5. Configuring the Default Sending Domain.
By default, mail is sent from my-domain.awsapps.com, so I set my-domain.com as the default.
Setting the Registered Domain as Default.
Domain / Domain status / Default domain
my-domain.awsapps.com / Verified / Default { Change default }
my-domain.com / Verified
Domain / Domain status / Default domain
my-domain.awsapps.com / Verified
my-domain.com / Verified / Default { Change default }
Change the default so that email addresses use @my-domain.com.
This completes the domain assignment.
4. Setting Up Users for Email Accounts.
For organizational use, you'd set up groups and assign users to them, but since this is for personal use, groups aren't needed — I'll go straight to setting up users.
The left-hand menu shows:
- Organizations
- What's new
- Organization
- Users
- Groups
- Resources
- Domains
- Mobile policies
- Organization settings
- Tags
- Access control rules
- Retention policies
- Impersonation roles
- Monitoring
- Logging settings
- Amazon Simple Email Service
Select "Users," register a user, and configure the email account. The following screen appears.
4-1. Configuring Users and Email Accounts.
Add a user Info
Add a user to your Amazon WorkMail organization.
User details
Username
{ Enter the username for logging into webmail. e.g. // my-admin@your.name // }
The username enables the user to login to the Amazon WorkMail webmail.
Username can only contain the following characters: a-z, A-Z, 0-9, _ (underscore), - (hyphen), . (dot) and @.
First name - optional
{ Enter the first name. e.g. // Taro // }
Last name - optional
{ Enter the last name. e.g. // Yamada // }
Display name
The name by which the user is presented in the system.
{ Enter the display name for administration. e.g. // Taro.Yamada // }
Email address
Primary email address to be used for this user.
{ Enter the email account. e.g. // yamada // } -> Select from @my-domain.com / @my-domain.awsapps.com
[1]Show in global address list { Select this option. e.g. // The account will appear within the organization. // }
By default, all enabled users appear in the global address list. You can hide a user from the global address list.
[2]Remote user
You can select this option if the user is in a remote system. This will create an address book entry for the user, but not a mailbox.
Password setup
Password
Password for the user to log in with.
{ Enter the password. e.g. // Set approximately 16 characters using uppercase, lowercase, numbers, and symbols. // }
Passwords have an 8-character minimum with at least one character from three of these four categories: lowercase, uppercase, numeric, and special characters.
Repeat password
{ Re-enter the password for confirmation. e.g. // the password set above // }
Registration
Cancel / Add user { Select Add user. // The user account configured above will be registered. // }
This completes the registration of the user and email account.
https://my-domain.awsapps.com/mail
Log in with the username and password you set, and the web-based mail client becomes available.
After logging in, select New item and click New email to compose a message. Sending a test email to another address confirms that mail is being sent successfully.
5. Configuring the Mail Client.
The web-based mail client provided by AWS defaults entirely to English with no Japanese option. Receiving notifications also requires logging in, so I configure things to send and receive mail through MacBook and iPhone as well.
On Mac, go to [System Settings] → [Internet Accounts] → [Add Account] → select [Microsoft Exchange], enter your name and the email account you configured, then click Sign In. Enter the password and sign in.
This makes the AWS email account usable in the Mac Mail app on MacBook and iPhone synced via iCloud.
// iCloud sync does not sync the email account to iPhone's mail client, so it needs to be set up separately.
// iPhone cannot be configured via Azure, so IMAP and SMTP need to be set up individually.
With this, Amazon WorkMail is configured, email accounts on the domain registered through Route 53 are set up, and email can be sent and received.
AWS Official Guide.
Official Administrator Guide
The administrator guide for Amazon WorkMail, covering configuration, usage, and user management.
Official User Guide
The user guide for Amazon WorkMail, covering configuration and usage.
6. What Was Done in the Amazon WorkMail Setup.
- Accessed the Amazon WorkMail console
- Configured the Organization (an organization in the WorkMail context)
- Since Organization is domain-based, I specified the domain registered in Route 53
- After registering the Organization, I assigned the domain to it
- Writing records to DNS completed the domain assignment, making email accounts ready to use
- I used Lightsail's DNS rather than Route 53
- Set up email accounts. Accounts must be obtained per user, with up to 30 aliases available per user
- Each user account assigned an email account incurs a usage fee of $4/month
- Once the email account was configured, I verified sending and receiving via the web mail client. After that, I added the account to the MacBook's native mail client
- I tested the configured email account with Drupal's contact form, but an error appeared and mail sending from the contact form wasn't working
- The next article covers tracing the cause of the contact form mail failure and addressing it
That's how things proceeded.
The mail account setup had been going smoothly, and sending and receiving worked fine in the mail client — but when I registered the account in Drupal's contact form and ran a test, mail wouldn't send. There are several possible reasons, so I work through them one by one.