How to Configure the SMTP Relay Service in Google Workspace for Scanners and Printers

The Problem with Legacy Hardware

Modern applications send emails using secure, modern APIs (like the Gmail API or Microsoft Graph). However, enterprise networks are filled with legacy hardware—networked scanners, multi-function printers, massive ERP systems, and older on-premise applications—that are only capable of sending emails via standard, unencrypted SMTP over Port 25.

If an employee scans a document and hits “Email to HR,” the scanner attempts to log into the mail server. Because Google Workspace enforces strict security (requiring TLS encryption and OAuth 2.0 authentication by default), Google will immediately reject the scanner’s archaic login attempt.

To allow your legacy hardware to send emails without compromising your entire domain’s security posture, you must configure the Google Workspace SMTP Relay Service.

Step 1: Accessing the Routing Settings

The SMTP Relay Service acts as a secure bridge. You explicitly authorize the IP address of your office network; when Google receives an unauthenticated email originating from that specific IP, it trusts it, accepts it, and routes it onward.

1. Log into the Google Workspace Admin Console using Super Administrator credentials.
2. Navigate to Apps > Google Workspace > Gmail > Routing.
3. Scroll down to the SMTP relay service section and click Configure.

Step 2: Configuring the Relay Parameters

A misconfigured SMTP relay turns your domain into an open spam proxy. You must configure the settings carefully.

1. Allowed senders: Select Only addresses in my domains. This ensures that even if a hacker compromises your office network, they cannot use your scanner to send spam masquerading as [email protected]; they can only send emails from [email protected].
2. Authentication: Select Only accept mail from the specified IP addresses.
   • Click Add and enter the static, public IP address of your corporate office (e.g., 198.51.100.45). Note: This must be the public IP provided by your ISP, not the internal IP of the scanner (like 192.168.1.10).
3. Require TLS encryption: Uncheck this box only if your legacy scanner absolutely does not support TLS. If the hardware supports it, leave it checked for security.
4. Require SMTP Authentication: Uncheck this box. The entire point of this relay is to authorize the traffic based on the IP address, bypassing the need for a username and password.
5. Click Save.

Step 3: Configuring the Local Hardware

It can take up to 24 hours for the new routing rules to propagate across Google’s global infrastructure, though it usually takes less than an hour. Once propagated, you must configure the physical scanner.

1. Log into the web interface of your network scanner or ERP system.
2. Navigate to the Email or Network settings.
3. Set the SMTP Server Address to: smtp-relay.gmail.com
4. Set the SMTP Port to: 25 (if unencrypted) or 587 (if using TLS).
5. Leave the Username and Password fields completely blank.

When the scanner attempts to send an email, it connects to smtp-relay.gmail.com. Google sees that the connection is originating from the authorized public IP address (198.51.100.45), verifies that the “From” address belongs to your domain, and successfully accepts and delivers the email.