Why We Built a Sovereign Direct Mail Delivery Engine Instead of Relying on AWS SES

The open secret of the modern email API market

In recent years, dozens of new email platforms have launched with sleek web dashboards, modern SDKs, and developer-friendly documentation.

What few customers realize is that the vast majority of these providers are not email delivery infrastructure companies at all. They are aesthetic HTTP proxies sitting in front of Amazon Simple Email Service (AWS SES).

When you call their API to send a transactional email, their application server transforms your JSON payload and forwards it directly to AWS SES via the Amazon API. AWS SES puts the message into its shared queues, signs it with whatever keys it manages, and performs the actual SMTP transmission to Gmail, Outlook, or Apple Mail.

The penalties of the middleman architecture

Relying on an underlying cloud middleman introduces severe architectural compromises for high-frequency transactional and agentic applications:

• Compounded Latency Penalties: Your API call travels to the proxy vendor, the proxy vendor authenticates and forwards to AWS SES, and AWS SES schedules it for delivery. This multi-hop relay adds hundreds of milliseconds of overhead.
• Shared Pool Reputation Degradation: Unless you pay substantial monthly fees for dedicated IP pools on AWS, your traffic shares egress nodes with thousands of unknown AWS accounts, increasing the risk of collateral spam folder placement.
• The Pricing Markup: You pay the proxy provider $20 to $100 per month for capabilities that cost Amazon a fraction of a cent, while still remaining subject to Amazon’s account-level pauses and strict review tickets.

Direct transmission to destination mail exchangers (Direct MX)

To achieve true deliverability sovereignty, SadaSend engineered its own dedicated mail delivery engine. Instead of handing messages to a third-party cloud queue, our sovereign transmission engine performs direct MX DNS lookups and establishes direct ESMTP connections with recipient mail servers.

This direct-to-MX architecture delivers concrete performance and operational advantages:

Dual-DKIM cryptographic signing on the wire

RFC 6376 governs DomainKeys Identified Mail (DKIM). Traditional providers rely solely on RSA keys—typically 1024-bit (which is now cryptographically discouraged) or 2048-bit.

SadaSend implements in-flight dual-DKIM signing. Every outbound transmission can be signed simultaneously with standard RSA-2048 (for broad backwards compatibility with legacy enterprise mailboxes) and high-performance Ed25519 elliptic curve cryptography.

This ensures your outbound mail passes strict cryptographic verification across modern mailbox providers while providing quantum-resistant cryptographic integrity for the next decade of email standards.