How to Configure a Local Postfix Server as a Google Workspace SMTP Relay

The Legacy Hardware Dilemma

If you have an office full of legacy multi-function printers, older ERP systems, or custom-built internal applications, those systems often do not support modern OAuth 2.0 authentication or strict TLS requirements. They simply want to connect to a local IP address on Port 25 and send an unauthenticated email.

Because Google Workspace enforces strict, modern security protocols, you cannot point these legacy devices directly to Google’s SMTP servers. Instead, you must build a “bridge.” The most common architectural solution is to build a lightweight Postfix SMTP Relay Server on your local network (usually on a small Ubuntu VM).

The legacy printers point to the local Ubuntu VM (which accepts unencrypted, unauthenticated mail). The Ubuntu VM then encrypts the mail, authenticates with Google Workspace, and securely relays the message to the internet.

Step 1: Preparing Google Workspace

Before configuring Postfix, you must authorize your corporate IP address within Google Workspace.

1. Log into the Google Workspace Admin Console.
2. Navigate to Apps > Google Workspace > Gmail > Routing.
3. Edit the SMTP relay service setting.
4. Add the public IP address of your corporate network.
5. Uncheck “Require SMTP Authentication” (because Postfix will authorize via the IP address), but ensure “Require TLS encryption” is checked.

Step 2: Installing Postfix on Ubuntu

Deploy a basic Ubuntu Server VM on your local network.

Install the Postfix package and the necessary SASL authentication libraries:

sudo apt-get update
sudo apt-get install postfix libsasl2-modules

During the installation wizard, select Internet with smarthost. Set the “System mail name” to your corporate domain (e.g., corp.com). Set the “SMTP relay host” to [smtp-relay.gmail.com]:587.

Step 3: Configuring the main.cf File

You must now edit the core Postfix configuration file to enforce TLS encryption when communicating with Google.

Open the file with root privileges:

sudo nano /etc/postfix/main.cf

Scroll to the bottom of the file and append the following directives to guarantee secure transmission to Google’s servers:

# Google Workspace Relay Configurations
relayhost = [smtp-relay.gmail.com]:587
smtp_use_tls = yes
smtp_tls_security_level = encrypt
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

Step 4: Defining Trusted Internal Networks

You must ensure that your new Postfix server does not become an open relay for the entire internet. You only want it to accept emails from your local internal subnets (e.g., the specific subnet where your printers reside).

Still in the main.cf file, locate the mynetworks directive and modify it to include your local subnets:

mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 192.168.10.0/24 10.0.50.0/24

Save and close the file.

Step 5: Restart and Test

Restart the Postfix service to apply the new configuration:

sudo systemctl restart postfix

Now, go to your legacy printer. Configure its SMTP server IP to be the internal IP address of this Ubuntu VM (e.g., 192.168.10.55) on Port 25, with no username or password. When you scan a document, the printer will hand it to Postfix, and Postfix will securely hand it to Google Workspace for delivery.