wraps email

All email commands operate against your AWS account using the credentials in your environment. Run wraps aws doctor if credentials are not resolving correctly.

Run any command with --preview to see what would change before deploying.

wraps email init

Deploy email infrastructure (SES, Lambda, DynamoDB, EventBridge) to your AWS account. If infrastructure already exists in the selected region, the CLI will exit early and prompt you to use wraps email upgrade instead.

wraps email init
npx @wraps.dev/cli email init

# Non-interactive with preset
wraps email init --provider vercel --region us-east-1 --domain yourapp.com --preset production --yes

# Preview changes without deploying
wraps email init --preview

-p, --provider

string

Hosting provider for your application. Accepted values: vercel, aws, railway, other. Determines how IAM roles and OIDC are configured.

-r, --region

string

AWS region to deploy infrastructure into (e.g., us-east-1). Defaults to your configured AWS region.

-d, --domain

string

Domain name to configure as the primary sending domain (e.g., yourapp.com).

--preset

string

Configuration preset. Accepted values: starter, production, enterprise, custom.

Preset	Est. cost	Features
`starter`	~$0.05/mo	Open/click tracking, bounce suppression
`production`	~$2–5/mo	+ Event tracking, 90-day history, reputation metrics
`enterprise`	~$50–100/mo	+ Dedicated IP, 1-year history, all event types
`custom`	varies	Configure each feature individually

-y, --yes

boolean

Skip confirmation prompts and deploy immediately.

--preview

boolean

Show a plan of all AWS resources that would be created without deploying.

wraps email connect

Connect to an existing SES deployment in your account. Use this when you already have SES infrastructure and want Wraps to manage it.

wraps email connect
wraps email connect --region us-west-2
wraps email connect --preview

-r, --region

string

AWS region where the existing SES infrastructure is deployed.

--preview

boolean

Preview what would be imported or changed without applying.

wraps email status

Display the current state of your email infrastructure — deployed region, configuration, domains, and resource ARNs.

wraps email status
wraps email status --region us-east-1
wraps email status --account 123456789012

--account

string

AWS account ID to look up. Defaults to the account resolved from your current credentials.

-r, --region

string

AWS region to inspect.

wraps email check

Run a deliverability audit on a domain. Checks DKIM, SPF, DMARC, MX records, TLS support on mail servers, DNS blacklists, and domain age. Exits with a non-zero code if the grade is below a threshold.

# Full audit
wraps email check yourapp.com

# Faster check — top blacklists only, fewer DKIM selectors
wraps email check yourapp.com --quick

# Machine-readable output
wraps email check yourapp.com --json

# Verbose: show all checks including passing ones
wraps email check yourapp.com --verbose

# Skip slow checks
wraps email check yourapp.com --skipBlacklists --skipTls

# Target a specific DKIM selector
wraps email check yourapp.com --dkimSelector s1

domain

string

Domain to audit (e.g., yourapp.com). If omitted, the CLI will prompt for it.

-q, --quick

boolean

Run fewer checks: top blacklists only and fewer DKIM selectors. Faster but less thorough.

-j, --json

boolean

Output results as JSON instead of the formatted terminal display.

--verbose

boolean

Show all checks, including those that passed.

--dkimSelector

string

Check a specific DKIM selector instead of probing common ones.

--skipBlacklists

boolean

Skip all DNS blacklist checks.

--skipTls

boolean

Skip MX server TLS (STARTTLS) checks.

--timeout

number

DNS query timeout in milliseconds.

wraps email verify

Verify that DNS records (DKIM CNAME, SPF, DMARC) are correctly configured for a domain in SES.

wraps email verify -d yourapp.com

-d, --domain

string

required

Domain to verify.

wraps email config

Apply configuration updates from your local CLI settings to the deployed infrastructure. Use this after modifying presets or email configuration in code.

wraps email config
wraps email config --region us-east-1 --yes

-r, --region

string

AWS region of the deployment to update.

-y, --yes

boolean

Skip confirmation prompt.

wraps email upgrade

Add features to an existing deployment without tearing it down. Prompts for which features to enable (tracking, history, dedicated IP, etc.).

wraps email upgrade
wraps email upgrade --region us-east-1 --yes
wraps email upgrade --preview

-r, --region

string

AWS region of the deployment to upgrade.

-y, --yes

boolean

Skip confirmation prompt.

--preview

boolean

Show what resources would be added without applying changes.

wraps email restore

Redeploy infrastructure from saved metadata. Useful for recovering a stack after manual changes or drift.

wraps email restore
wraps email restore --region us-east-1
wraps email restore --force

Restore overwrites the current Pulumi state with what is stored in ~/.wraps/. Only run this if you understand what state will be restored.

-r, --region

string

AWS region of the deployment to restore.

-f, --force

boolean

Skip confirmation prompt.

--preview

boolean

Show what would change without applying.

wraps email destroy

Remove all email infrastructure deployed by Wraps from your AWS account. Resources with the wraps-email-* prefix and ManagedBy: wraps-cli tag are deleted.

wraps email destroy
wraps email destroy --force
wraps email destroy --preview

This is irreversible. All SES configuration sets, Lambda functions, DynamoDB tables, and EventBridge rules created by Wraps will be deleted.

-f, --force

boolean

Skip the confirmation prompt. Do not use in automation without testing first.

-r, --region

string

AWS region of the deployment to destroy.

--preview

boolean

Show which resources would be deleted without deleting them.

Email domains

Subcommands for managing sending domains registered in SES.

add
list
get-dkim
verify
remove

Add a new domain (or subdomain) to SES for sending. Creates a SES identity with DKIM, optionally configures a MAIL FROM subdomain, and offers to create DNS records automatically.

wraps email domains add -d yourapp.com
wraps email domains add -d mail.yourapp.com

-d, --domain

string

required

Domain to add.

List all SES domains in the current region, including their verification and DKIM status. Managed domains (tracked by Wraps) are shown separately from unmanaged ones.

wraps email domains list

Retrieve the DKIM CNAME records that must be added to your DNS provider for a domain.

wraps email domains get-dkim -d yourapp.com

-d, --domain

string

required

Domain to get DKIM records for.

Check the DKIM, SPF, and DMARC DNS records for a domain against what SES expects. Reports which records are verified, incorrect, or missing.

wraps email domains verify -d yourapp.com

-d, --domain

string

required

Domain to verify.

Remove a domain from SES and from Wraps metadata. Prompts for confirmation unless --force is passed.

wraps email domains remove -d yourapp.com
wraps email domains remove -d yourapp.com --force

If the domain is the primary domain (managed by Pulumi), --force is required. To remove all infrastructure, use wraps email destroy instead.

-d, --domain

string

required

Domain to remove.

-f, --force

boolean

Skip confirmation. Also required to remove the primary domain.

Email inbound

Subcommands for deploying and managing inbound email receiving (SES receipt rules + S3 + Lambda). Requires outbound email infrastructure to be deployed first.

Inbound email is only supported in regions where SES has receiving capability. The CLI will error if you target an unsupported region.

init
status
verify
test
destroy

Deploy inbound email infrastructure: S3 bucket for storage, Lambda for processing, SES receipt rules, and DNS records.

wraps email inbound init
wraps email inbound init --region us-east-1 --yes
wraps email inbound init --preview

# Use a specific receiving subdomain
wraps email inbound init -d inbound

-r, --region

string

AWS region to deploy inbound infrastructure.

-d, --domain

string

Subdomain prefix for the receiving address (e.g., inbound → inbound.yourapp.com). Defaults to inbound when --yes is passed.

-y, --yes

boolean

Skip all confirmation prompts.

--preview

boolean

Show changes without deploying.

Show the current inbound email configuration: receiving domain, S3 bucket, webhook URL, and receipt rule set status.

wraps email inbound status
wraps email inbound status --region us-east-1

-r, --region

string

AWS region to inspect.

Check that the MX and SPF DNS records for the inbound receiving domain are correctly configured and that the SES receipt rule set is active.

wraps email inbound verify
wraps email inbound verify --region us-east-1

-r, --region

string

AWS region to check.

Send a test email to the receiving domain and poll S3 to confirm it was processed. Times out after 30 seconds.

wraps email inbound test
wraps email inbound test --region us-east-1

-r, --region

string

AWS region of the inbound deployment.

Remove all inbound email infrastructure: SES receipt rules, S3 bucket, and Lambda. Does not remove the outbound SES setup.

wraps email inbound destroy
wraps email inbound destroy --force

This removes the SES receipt rule set. Emails to the receiving domain will no longer be processed after this command completes.

-r, --region

string

AWS region of the deployment to destroy.

-f, --force

boolean

Skip confirmation prompt.

Get Started

CLI Reference

Guides

Configuration

wraps email init

wraps email connect

wraps email status

wraps email check

wraps email verify

wraps email config

wraps email upgrade

wraps email restore

wraps email destroy

Email domains

Email inbound

Build docs developers (and LLMs) love

Get Started

CLI Reference

Guides

Configuration

​wraps email init

​wraps email connect

​wraps email status

​wraps email check

​wraps email verify

​wraps email config

​wraps email upgrade

​wraps email restore

​wraps email destroy

​Email domains

​Email inbound

Build docs developers (and LLMs) love

wraps email init

wraps email connect

wraps email status

wraps email check

wraps email verify

wraps email config

wraps email upgrade

wraps email restore

wraps email destroy

Email domains

Email inbound