1. Minimal IAM policy for sending (attach to the IAM user whose keys you paste below):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AppLeadSesSend",
      "Effect": "Allow",
      "Action": [
        "ses:SendEmail",
        "ses:SendRawEmail"
      ],
      "Resource": "*"
    }
  ]
}

For the Test Credentials button, also allow ses:GetSendQuota and ses:GetIdentityVerificationAttributes (or use the SES console to confirm verification).

2. Verify your sender domain in Amazon SES (same region as below), then add DNS records at GoDaddy (or your DNS host):

1. In AWS SES → Identities → Create identity → Domain (e.g. yourcompany.com).
2. Copy the CNAME records SES shows for DKIM (usually 3 names like xxxx._domainkey).
3. In GoDaddy → DNS → Add → CNAME: paste each Host + Points to value. TTL can stay default.
4. Add an SPF TXT record on @ (or merge with your existing SPF): v=spf1 include:amazonses.com ~all
5. Wait for DNS propagation, then confirm the identity shows Verified in SES before sending live mail.

Sandbox accounts can only send to verified recipient addresses until you request production access in SES.