After replatforming to AWS, a migrated server hosts a legacy SMTP service required by a critical app. The legacy SMTP server sends outbound email over unencrypted TCP port 25 and does not support TLS. The company validated an Amazon SES domain and removed SES sending limits. How should the application be changed to send outbound mail through Amazon SES?

The correct answer is to configure the application to use SMTP with STARTTLS and generate Amazon SES SMTP credentials. The legacy SMTP server sends outbound email over unencrypted TCP port 25, but Amazon SES requires secure communication. STARTTLS upgrades an unencrypted connection to an encrypted one, allowing the application to use its existing SMTP capabilities while meeting SES security requirements. Amazon SES SMTP credentials provide the necessary authentication. The other options are incorrect because: A TLS wrapper would require significant application modification or a proxy, which is more complex than simply configuring STARTTLS. Modifying the application to call the Amazon SES API directly or using an AWS SDK would require substantial code changes to the legacy application, which is not ideal for a "replatformed" scenario aiming for minimal disruption.