Google Workspace includes an SMTP relay service that lets your own applications, printers, scanners and servers send email through Google's infrastructure, using your domain, without logging in as an individual user. It is a convenient feature for offices and small systems, and it is often confused with two other things: the ordinary Gmail SMTP server that a person uses to send from their own mailbox, and a dedicated sending service built for large volumes. Knowing which is which saves hours of troubleshooting. This guide explains what the Google Workspace SMTP relay service is, how it differs from smtp.gmail.com, what you need before you start, how to configure it step by step in the Admin console, the authentication choices, the limits to respect, common errors and when to use a different service. Check Google's current documentation before you rely on any figure or menu name, because the product changes.
What is the Google Workspace SMTP relay service?
The SMTP relay service is a feature of Google Workspace that accepts mail from your applications or devices and delivers it to recipients inside or outside your organisation. You enable it in the Admin console and decide how senders are verified: by the IP address they connect from, by SMTP authentication with a Workspace account, or both. Unlike the standard Gmail SMTP service, it can send as any address in your domain, not just the account that logs in, and it can carry more flexible settings. It is available to Google Workspace customers; free personal Gmail accounts do not have it. Our article on Gmail SMTP settings covers the ordinary smtp.gmail.com service used with a single mailbox.
SMTP relay service versus smtp.gmail.com
| Feature | smtp.gmail.com | smtp-relay.gmail.com |
|---|---|---|
| Who it is for | One person sending from their own mailbox with an app | An organisation sending from applications and devices |
| Authentication | The mailbox user's credentials, often an app password | Allowed IP addresses, SMTP authentication or both |
| Sender address | The signed-in account, with limited aliases | Any address in your domains, depending on settings |
| Configuration | On the client only | In the Admin console and on the client |
| Availability | Gmail and Workspace accounts | Workspace only |
Before you start
- You need administrator access to the Google Admin console for your Workspace domain.
- Decide which senders will use the relay: a fixed office IP address, a server with a static address or individual accounts.
- Your domain should have SPF that includes Google, and DKIM enabled for Workspace. See authenticating your sending domain.
- Check that your network permits outbound connections on the port you intend to use. Many hosts and internet providers block port 25. See SMTP ports explained.
How to set up the SMTP relay service
- Open the Admin console and go to the Gmail settings for your domain, then to the routing section. Menu names move around, so search the console for "SMTP relay service" if you cannot find it.
- Add a setting for the SMTP relay service. Give it a clear name, such as "Office printers" or "Billing server".
- Choose the allowed senders. Options include only addresses in your domains, or any address, and the choice affects whether the relay will send mail from other domains. Pick the narrowest option that works.
- Choose how to authenticate. Select "Only accept mail from the specified IP addresses" and list them, or require SMTP authentication, or use both. IP-based allowlisting is simple for fixed servers and printers. SMTP authentication is better when the sender's address changes.
- Require TLS encryption if your clients support it. This is the safer setting and is recommended wherever possible.
- Save the setting. It can take some time to take effect, so wait before testing.
- Configure the client: host smtp-relay.gmail.com, a port supported by the service (Google documents ports 25, 465 and 587), the encryption mode that matches the port, and credentials if you required authentication.
- Send a test message and check the headers to confirm that it was delivered and signed. See how to test an SMTP connection.
Which authentication method to pick
- IP allowlist. Works for devices that cannot store a password, such as older printers. Requires a stable public IP address. Anyone who can send from that address can relay, so secure the network.
- SMTP authentication. Works for roaming applications and cloud servers. Use a dedicated account with a strong password and multi-factor handling suited to service accounts, and never reuse a person's login.
- Both. Stricter, because a sender must come from an approved address and present valid credentials.
Limits and policies to respect
Google applies sending limits to the relay service, including daily limits on recipients and limits per message. The numbers are published in Google's help pages and can change, so look them up rather than relying on a figure from an old article. The service is designed for the mail your organisation produces: alerts, scanned documents, invoices and notifications. It is not designed to deliver marketing campaigns or large newsletters to external audiences. Heavy sending can trigger limits, temporary blocks and damage to the reputation of your Workspace domain, which then affects your staff's ordinary email.
Common errors and fixes
| Symptom | Likely cause | Fix |
|---|---|---|
| Connection times out | Outbound port blocked by your network or host | Try another supported port or ask the network owner |
| Relay access denied | The sending IP address is not on the allowlist, or authentication is required but missing | Add the correct public IP or supply credentials |
| Authentication failed | Wrong account, or security settings block the sign-in | Use a dedicated service account and confirm the setting applies |
| Mail accepted but lands in spam | SPF, DKIM or DMARC problems, or content issues | Check records with the SPF, DKIM and DMARC checker |
| Sender address rejected | The allowed-senders setting forbids that address | Adjust the setting or use an address in your domain |
| Works for some recipients, not others | Daily or per-message limits, or recipient-side filtering | Check usage and the bounce text; see SMTP bounce codes |
Security tips
- Limit relay to the minimum set of IP addresses and accounts.
- Use TLS for every connection.
- Review the relay settings every few months and remove unused entries.
- Do not let a public web form send directly through the relay without validation and rate limits, or spammers will use it.
- Publish a DMARC policy and watch reports for unexpected sources. See DMARC aggregate reports.
When a dedicated sending service is the better choice
If your application sends receipts, password resets or notifications to customers, or if you send newsletters, a service built for that job is a better fit. It offers reputation management for sending addresses, automatic bounce and complaint processing, suppression lists, event webhooks and detailed logs, which the Workspace relay does not. It also keeps your customer mail separate from your employees' mailboxes, so a deliverability problem in one does not damage the other. Compare the options in SMTP servers versus SMTP services, read the general overview in SMTP relay explained and see how to separate transactional and marketing streams.
Need a relay built for application email? Use an SMTP relay or email API designed for customer-facing mail, with bounce handling and reporting.
References and further reading
Frequently asked questions
What is the Google Workspace SMTP relay service?
A Workspace feature that lets your applications and devices send mail through Google using your domain, controlled by allowed IP addresses, SMTP authentication or both.
What is the difference between smtp.gmail.com and smtp-relay.gmail.com?
smtp.gmail.com is for one person's mailbox using their credentials. smtp-relay.gmail.com is an organisation-level relay configured in the Admin console that can send as addresses in your domain.
Can I use a free Gmail account as an SMTP relay?
The relay service is a Google Workspace feature. Personal Gmail accounts can use smtp.gmail.com with limits but do not have the relay service.
Can I send marketing emails through the Google relay?
It is designed for your organisation's own mail, such as alerts and documents. Marketing campaigns and large volumes risk limits and damage the reputation of your domain.
Why do I get a relay access denied error?
Usually the sending IP address is not on the allowlist or authentication is required but missing. Check the Admin console setting and the public IP of the sender.