Setup guides

How do you set up the Google Workspace SMTP relay service?

By iBlockSpam Team How we check our guides Updated Oct 22, 2026 10 min read 6 sources

Short answer

In the Admin console, go to Apps > Google Workspace > Gmail > Routing, find SMTP relay service and click Configure. Choose allowed senders, require IP address or SMTP authentication, tick Require TLS encryption, and save. Then point the device or server at smtp-relay.gmail.com on port 587 with TLS, or port 25, 465 or 587 without it.

On this page 9 sections

Printers, scanners, websites, line-of-business apps and on-premises mail servers all need a way to send email as your domain. In Google Workspace, the cleanest route is the SMTP relay service: an admin-configured relay at smtp-relay.gmail.com that accepts mail from your devices and delivers it through Google. This guide covers the setup, every option, limits, and what each relay error means.

What is the Google Workspace SMTP relay service?

The SMTP relay service is a Google Workspace feature that accepts outgoing mail from your organization's devices, applications and mail servers and sends it on through Google's servers. Google says it lets you "filter messages for spam and viruses before they reach external recipients" and "apply email security and advanced Gmail settings to outgoing messages" (Google Workspace Admin Help).

A relay (or smart host) is a mail server that forwards mail on behalf of other systems. Our explainer on smart hosts and SMTP relays covers the concept. Google's relay is meant for "on-premise devices and applications." Google warns against using it to relay mail that already came from Gmail, for example through an outside gateway and back, because it "can result in mail loops, excessive email quota use, and increased security risk."

Which Google sending option should you use?

Google offers three ways for a device or app to send mail, and recommends the relay (Google Workspace Admin Help):

Item	SMTP relay service (recommended)	Gmail SMTP server	Restricted Gmail SMTP server
Hostname	`smtp-relay.gmail.com`	`smtp.gmail.com`	`aspmx.l.google.com`
Ports	25, 465 or 587	465 (SSL) or 587 (TLS)	25
Authentication	IP address or SMTP AUTH	User's address and an app password	None; add the device IP to the Gmail allowlist
Who it can send to	Anyone	Anyone	Gmail and Google Workspace users only
Daily limit	10,000 messages per user	2,000 messages	Per-user Workspace limits
Admin setup	Yes, under Gmail > Routing	No	IP allowlist plus SPF

Google also notes that from May 1, 2025, Workspace accounts "no longer support less secure apps" that sign in with a username and password. Old scanners that can't do OAuth or app passwords are a good reason to use the relay with IP authentication. If you do use smtp.gmail.com, our guide to Gmail SMTP settings and app passwords covers the ports, limits and common errors.

How do you set up SMTP relay in the Admin console?

You need the Gmail Settings administrator privilege. Google says the relay setting can be added, edited and deleted "at the top-level organization only."

In the Google Admin console, go to Menu > Apps > Google Workspace > Gmail > Routing.
Scroll to SMTP relay service and click Configure, or Edit or Add another rule if one exists.
Enter a name, for example Office scanners.
Under Allowed senders, choose one option (see the table below).
Under Authentication, tick Only accept mail from the specified IP addresses, Require SMTP Authentication, or both. For IP addresses, click Add, enter a description and your public IPv4 or IPv6 address or range, and keep Enable ticked.
Under Encryption, tick Require TLS encryption if every sender supports TLS.
Click Save. Google says changes "can take up to 24 hours but typically happen more quickly."

What do the options mean?

Option	What Google says it does	Our advice
Only registered Apps users in my domains	Sender "must be a Google Workspace user in one of your domains"	Use for staff mail clients and servers that send as real users
Only addresses in my domains	Sender address must contain your primary domain (subdomains allowed), but needn't be a user; "useful when you use third-party or custom applications"	Use for scanners and apps with addresses like `scanner@example.com`
Any addresses (not recommended)	Any sender address, which "makes you more vulnerable to abuse"	Avoid
Only accept mail from the specified IP addresses	Accepts only listed IPs; up to 65,536 addresses per range	Keep ranges "as small as possible," as Google advises
Require SMTP Authentication	Checks "the user Google Workspace email address and password"; needs TLS	Use where the source IP changes
Require TLS encryption	Rejects connections that don't use TLS	Turn on unless an old device can't do TLS

With Any addresses, Google rewrites a sender from a domain you don't own to postmaster@ your domain unless the server uses SMTP AUTH or presents one of your domains in HELO. And when the MAIL FROM address belongs to a registered user, that user needs a license that includes Gmail.

How do you point a device or server at the relay?

Use these settings on the device, app or mail server:

Field	Value
SMTP server	`smtp-relay.gmail.com`
Port with TLS	587
Port without TLS	25, 465 or 587 (IP authentication only)
Username and password	Only if you chose SMTP AUTH
HELO/EHLO name	Your server's own name, not `localhost`

Port 587 is the standard mail submission port described in RFC 6409; our guide to SMTP ports 25, 587 and 465 explains the differences. Google recommends unique HELO or EHLO names, "for example, use your domain name or the server name, instead of generic identifiers such as localhost or smtp-relay.gmail.com."

For a Linux server running Postfix, the core settings are two lines in main.cf (example):

relayhost = [smtp-relay.gmail.com]:587
smtp_tls_security_level = encrypt

Reload Postfix and send a test. Google's own Postfix example uses relayhost = smtp-relay.gmail.com:25; Google says to use port 587 when you connect with TLS. The square brackets stop Postfix looking up MX records for the relay name.

What are the SMTP relay limits?

At the time of writing (October 2026), Google lists:

10,000 messages per user in a 24-hour period, and no more than 10,000 unique recipients per user per day.
100 recipients per SMTP transaction; start a new connection or send RSET for more.
4.6 million non-unique recipients per organization in 24 hours, and 319,444 per 10-minute window.
Lower limits for trial accounts and accounts that haven't paid a bill.

Per-user limits count against the envelope sender. If that isn't a registered user, per-user limits don't apply. Relay limits are "independent and counted separately" from Gmail's own sending limits, which our guide to sending limits in Microsoft 365 and Google Workspace covers.

What do SMTP relay errors mean?

Google documents these messages (Google Workspace Admin Help). Causes are listed most likely first.

Error text (as returned)	Likely cause	Fix
Mail relay denied	The device's IP isn't in the relay setting, or HELO/MAIL FROM doesn't identify your domain	Add the public IP; send a real hostname in HELO and a valid MAIL FROM
Invalid credentials for relay	The registered IP doesn't match the sending account's domain	Use SMTP AUTH, or present one of your domains in HELO/EHLO
Daily SMTP relay limit exceeded for user	One sender hit the per-user cap	Spread mail across senders or reduce volume
Daily SMTP relay limit exceeded for customer	The organization hit its cap	Review sending volume
Peak SMTP relay limit exceeded for customer	Too fast; Google says "this is a temporary error" and mail is deferred	Slow down and retry with backoff
Your message has too many recipients	More than 100 recipients in one transaction	Split into batches
Message exceeded 50 hops, this may show a mail loop (554 5.4.6)	Mail is cycling, often Gmail to gateway and back	Remove the loop; see 554 5.4.6
Cannot sign in due to a temporary problem or too many sign-in attempts (454 4.7.0)	Authenticating once per message	Reuse connections and retry with exponential backoff

For any other code, look it up in our SMTP error code reference.

How does relayed mail affect SPF, DKIM and DMARC?

Relayed mail leaves from Google's servers, so check its authentication like any other mail you send. Google's recommended SPF record for a domain that sends only through Google Workspace is v=spf1 include:_spf.google.com ~all (Google Workspace Admin Help). Google's relay page doesn't spell out DKIM signing for relayed mail, so verify it yourself:

Send a test from the device to an outside mailbox.
Open Show original and read Authentication-Results in the Email Header Analyzer.
Confirm spf=pass and a dkim=pass for your own domain (header.d= or header.i= showing it).
Check your published records with the SPF Checker and DKIM Checker.

Moving devices onto the relay is also how you stop your own scanners tripping Gmail's spoofing and authentication protection.

How do you keep the relay from being abused?

Never choose Any addresses unless you must, and never list a whole cloud provider's IP range.
Prefer SMTP AUTH with TLS for anything off your office network.
Keep the system-defined alert User suspended for spamming through relay on; Google lists it as active by default (Google Workspace Admin Help). Google also says it emails super administrators if it detects "a significant amount of spam" through the relay.
Review the relay's IP list whenever an office or hosting provider changes.

Next steps

List every device and app that sends as your domain, and move each one to the relay or to its own authenticated service.
Test one device end to end and confirm SPF and DKIM pass in the headers.
Turn on Require TLS encryption once every sender supports it.
If you'd rather send through a relay that also filters and DKIM-signs outgoing mail, iBlockSpam's outbound relay includes 500 messages a month per domain.

See all spam filter setup guides.

Frequently asked questions

What is the hostname for the Google Workspace SMTP relay?

The SMTP relay service uses smtp-relay.gmail.com. Google says to use port 587 when you connect with TLS, and port 25, 465 or 587 without TLS. Without TLS you can't use SMTP authentication and must authenticate the device by its IP address instead. Don't confuse it with smtp.gmail.com, which needs a user sign-in.

Is smtp-relay.gmail.com the same as smtp.gmail.com?

No. smtp-relay.gmail.com is the organization's relay, configured by an admin and authenticated by IP address or SMTP AUTH, with a 10,000-message daily limit per user. smtp.gmail.com is the Gmail SMTP server, which needs a user's address and an app password, and Google lists a 2,000-message daily limit for it.

Why does Google's SMTP relay say Mail relay denied?

Google says Mail relay denied means the mail comes from a domain or IP address that isn't registered in your SMTP relay settings. Add the device's public IP to the setting, or switch it to SMTP authentication over TLS. Also check that the device sends a proper hostname in HELO and a valid MAIL FROM address at your domain.

How many emails can I send through Google Workspace SMTP relay?

At the time of writing (October 2026), Google lists 10,000 messages per user in 24 hours, 10,000 unique recipients per user per day and 100 recipients per SMTP transaction. Organization-wide, the limit is 4.6 million non-unique recipients per 24 hours. Trial accounts and accounts with an unpaid bill get lower limits.

Can I use Google's SMTP relay without a static IP address?

Yes, with SMTP authentication. Tick Require SMTP Authentication, connect over TLS on port 587 and sign in with a Google Workspace account. IP address authentication needs a predictable public IP, so Google's printer guidance notes that relay authentication might require a static IP address.

Sources

See how your domain measures up

Run a free Email Health Check: MX, SPF, DKIM, DMARC and transport security in one scan, with the raw records shown. No sign-up.

Keep reading