Google Workspace SMTP Relay Setup

Why Your App Needs Proper SMTP Relay Configuration with Google Workspace

You send a welcome email after signup. It disappears into the void. No bounce, no error—just silence. Your users never get it. This isn’t bad luck. It’s misconfigured SMTP.

Google Workspace’s SMTP relay is your app’s bridge to reliable email delivery. Without it, your app’s outbound messages are treated like spam by default—low trust, high rejection. Proper configuration ensures every email from your app passes the inbox filter with authority.

Setting up Google Workspace SMTP relay isn’t just technical detail. It’s the difference between your app being trusted and being blocked. This guide shows how to do it right—step by step, with no guesswork.

Key takeaways

Google Workspace’s SMTP relay must be explicitly enabled and configured with proper authentication to prevent delivery failures.
Without relay configuration, app-generated emails from custom domains are often rejected or marked as spam, even if the address is valid.
Proper relay setup improves deliverability by leveraging Google’s sender reputation and aligning with authentication standards like SPF, DKIM, and TLS.

How Google Workspace SMTP Relay Works: The Mechanics You Should Know

Google Workspace SMTP relay acts as a secure proxy between your application and Google's mail servers. It uses your domain’s SPF, DKIM, and authenticated user credentials to validate that your app is authorized to send mail on your domain’s behalf. Only users with proper permissions can send through the relay, which reduces abuse risk and improves inbox placement.

Authentication and Identity Validation

When your app sends email via Google Workspace SMTP relay, it doesn’t connect directly to Gmail’s servers. Instead, it routes through Google’s infrastructure after authenticating with a username and password (or OAuth). This step ensures that only authorized users or systems can send mail from your domain.

Once authenticated, Google checks your domain’s SPF record to verify the sending IP is allowed. It also validates DKIM signatures—cryptographic proofs that the message wasn’t altered in transit. These checks are standard in email deliverability: SPF and DKIM are part of industry-standard email authentication practices, as outlined in RFC 5321 and RFC 6376.

Reducing Abuse and Improving Deliverability

Because the relay enforces authentication before delivery, it prevents unauthorized apps, bots, or compromised systems from sending spam using your domain. Only users with active Google Workspace accounts and proper permissions can use the relay, significantly reducing the risk of being flagged by spam filters.

This control directly impacts sender reputation. ISPs and inbox providers like Gmail, Outlook, and Yahoo track sending behavior. If your app sends consistently from a trusted, authenticated source, your messages are more likely to land in the inbox rather than the spam folder.

It’s worth checking your app’s email addresses before sending—especially if they’re from user inputs or imported lists. Invalid or disposable addresses add no value and can harm your sender reputation. MailTester’s real-time verification API helps you test individual addresses before sending: verify email validity with a single API call. For larger lists, use bulk verification to clean your database proactively.

While Google’s SMTP relay handles infrastructure and authentication, consistent deliverability still depends on content, volume, and list hygiene. Using tools like MailTester to validate your sending list gives you a clearer picture of what actually reaches inboxes—without relying solely on Google’s system.

Google Workspace SMTP Relay Configuration: Step-by-Step Guide

You can configure Google Workspace SMTP relay in minutes by enabling it in the Admin Console, specifying allowed users or groups, setting source IP restrictions if sending from a cloud server, then using smtp-relay.gmail.com with port 587, TLS, and generated credentials in your app. This keeps outbound email authenticated, reduces spam risk, and avoids rate limits. For context, Google’s approach aligns with industry standards like RFC 5321 and 5322, which govern SMTP behavior and message structure.

Set Up SMTP Relay in Google Admin Console

Log in to your Google Admin Console using a super-admin account. Without super-admin access, you can’t modify relay settings or assign permissions.
Navigate to Apps > G Suite > Gmail > SMTP Relay Settings. This screen controls how external apps use Gmail’s servers to send mail.
Enable the SMTP relay. You’ll then choose which users or groups can send emails via the relay. Limiting access reduces exposure to abuse and helps maintain sender reputation.
Specify the source IP range if your app runs on a cloud server (e.g., AWS EC2, Azure VM). Google checks this IP against the allowed list—failure here blocks delivery.
Generate SMTP credentials. You’ll get a username (often your domain), a password, and the required port (587). Store these securely—lost credentials require re-generation.

Configure Your App and Test Delivery

In your application, set the outgoing mail server to smtp-relay.gmail.com, use port 587, enable TLS encryption, and authenticate with the generated username and password. This setup uses Google’s infrastructure to send email while preserving your domain’s reputation.

The 5 steps described in “Set Up SMTP Relay in Google Admin Console”, in order.

When testing, verify that emails arrive in inboxes, not spam folders. Tools like Spamhaus or MxToolbox can help diagnose issues. Common problems stem from misconfigured IPs, incorrect credentials, or failing SPF/DKIM checks.

If you’re sending transactional or marketing emails at scale, pre-verification helps avoid send failures. Use MailTester’s bulk list verification to clean your recipient base before sending—validating addresses reduces bounces and protects your sender reputation.

Common Pitfalls in Google Workspace SMTP Relay Setup

You often hit authentication errors or blocked connections when setting up Google Workspace SMTP relay because of misconfigured ports, unauthorized user accounts, SPF misalignment, stale passwords, or unapproved IP addresses. These missteps break deliverability before email even leaves your server. Let’s go through the most common issues that silently sabotage app email delivery.

Port and Connection Misconfigurations

Using port 25 instead of 587 is a frequent mistake—Google blocks outbound traffic on port 25 by default to prevent spam. Use port 587 with TLS encryption to comply with modern email policies.
Some systems still rely on older, unencrypted ports. Check your app or server settings: if port 25 is listed, disable it. You can confirm current port requirements in the Google Workspace SMTP documentation.

Authentication and Authorization Errors

Google Workspace permits SMTP relay only for users explicitly granted permission. Sending from an account not part of the domain or not enabled for relaying will be rejected during authentication.
SPF alignment is required: your app’s sending domain must match the domain in the From header, and the SPF record must include Google’s mail servers. An SPF misalignment causes immediate rejection by receiving servers.
SMTP credentials must be rotated regularly. If your app uses a saved password, and a user resets their password in Workspace, the old credentials fail. You’ll get a 535 authentication error—no amount of retries will fix it unless you update the password in the app.
Never send from unknown IP addresses. Google requires you to white-list every IP used for SMTP relay in the Admin Console. Failure to do so results in IP-based blocking by Google’s anti-abuse systems.

These setup flaws don’t show errors in real time—they silently cause bounce rates, spam complaints, and reduced inbox placement. Validate your email list before sending to avoid waste. Use real-time verification to catch invalid addresses and risky sender patterns early.

Try MailTester’s email checker to validate individual addresses or verify your entire sending list for deliverability risks before deployment.

How to Verify Your App's Email Delivery After SMTP Relay Setup

After configuring your Google Workspace SMTP relay, verify deliverability by testing real user addresses with MailTester’s real-time API, sending small batches to check inbox placement, comparing app log bounces to MailTester’s validation results, and inspecting message headers for SPF, DKIM, and DMARC alignment. This ensures your app’s emails reach inboxes, not spam folders or dead ends.

Validate Addresses Before Sending

Before your app sends emails, run addresses through MailTester’s real-time verification API. It checks for syntax, domain validity, and mailbox responsiveness in under 100ms per address. Use this to filter out invalid or risky addresses before hitting your SMTP relay. Check individual addresses or verify entire lists in bulk to prevent bounces and protect sender reputation.

Test Inbox Placement and Monitor Results

Send a small batch of test emails through your app and use MailTester’s inbox-placement tester to see where they land. This tool simulates delivery to major providers like Gmail, Outlook, and Yahoo, giving you a real-world view of delivery success. It’s not just about delivery — it’s about whether your emails make it to the inbox, not the spam folder.

Review your app’s error logs for bounces. Then cross-check those with MailTester’s verdicts — valid, invalid, catch-all, or risky — to understand why some emails failed. For example, a “catch-all” domain might accept your email but not deliver it, leading to high bounce rates without real delivery. Catch-all detection is a key signal in preventing wasted sends.

Finally, examine the raw headers of delivered messages. Look for SPF, DKIM, and DMARC checks. Misalignment in any of these protocols causes deliverability issues, even with proper SMTP relay setup. The RFC 5322 standard defines email message formatting, and compliance with authentication standards is non-negotiable for inbox placement. Use Gmail’s “Show original” feature to inspect headers and confirm alignment.

These steps aren’t optional. They’re how you confirm your SMTP relay isn’t just configured — it’s actually working as intended.

The Role of Email Verification in Securing SMTP Relay Outputs

Every email sent via Google Workspace SMTP relay costs you a credit and impacts your sender reputation. Sending to invalid, disposable, or role-based addresses wastes resources and increases spam risk. MailTester’s 98.9% accurate email verification catches these issues before they go out, reducing bounce rates by 70% or more in typical cases. This prevents reputational damage and keeps your outbound volume efficient.

Why Unverified Sends Hurt Your Deliverability

SMTP relays like Google Workspace don’t block malformed or bad addresses—they just deliver them, and the results get logged. If hundreds of messages bounce or go to spam traps, your IP reputation tanks. That impacts all future sends, even from trusted sources. Role-based addresses (like admin@ or sales@) often act as catch-alls or are ignored entirely. Disposable domains (like mailinator.com) are almost always invalid and frequently abused by bots.

Let’s be clear: every failed delivery erodes your sender score. According to the Messaging, Malware, and Mobile Anti-Abuse Working Group (M3AAWG), consistent high bounce rates are a red flag for email providers. The more you send to bad addresses, the more likely you are to be flagged or throttled—even if your content is clean.

How Real-Time Validation Fits Into Your Send Pipeline

MailTester’s bulk verification tool lets you pre-clean large lists before they ever touch your SMTP relay. It checks for syntax, domain validity, MX records, and known disposable domains. You’ll catch 98.9% of invalid addresses before sending, which means fewer bounces and less stress on your infrastructure.

For active onboarding or transactional workflows, integrate the MailTester API directly into your application. Validate each email as users sign up—no queueing, no manual review. You’re not just screening; you’re building a clean data foundation from day one.

To check individual addresses instantly during development or debugging, use the email checker tool on the same page. It gives real-time feedback on domain status, inbox likelihood, and risk flags—no setup required.

For a full picture, test inbox placement with MailTester’s inbox tester—see if your messages land in the inbox, spam, or get blocked at all. This complements your verification strategy by testing real-world deliverability, not just validity.

With no credit expiration and 100 free verifications to start, MailTester gives you flexibility. You’re not locked into a limited plan. Integrate early, verify often, and send only to addresses that have a real chance of engaging.

Why List Hygiene Matters Before Using Google Workspace SMTP Relay

Using Google Workspace SMTP relay without cleaning your email list increases the risk of spam complaints, bounces, and reputation damage. Dirty lists—especially those with role accounts, disposable domains, or invalid addresses—trigger spam filters and can lead to your domain being blocked. A clean list with low bounce rates helps maintain sender reputation, which directly impacts inbox placement over time. Before sending at scale, verify your list to avoid these pitfalls.

The Hidden Risks in Your Email List

Even if your list looks complete, it likely contains addresses that won’t engage—or worse, that’ll hurt your sender score. Role accounts like admin@, support@, or sales@ are rarely used for personal email and often trigger anti-spam systems. Similarly, disposable domains like mailinator.com or tempmail.org are designed to self-destruct and are consistently flagged by filters.

Let’s be clear: sending to these addresses isn’t just wasteful—it’s risky. Many providers track sender behavior and flag repeated sends to known disposable or role-based accounts. If your domain starts sending to them frequently, it can signal poor list quality. Over time, this damages reputation even if the bulk of your list is valid. You don’t need to guess which addresses to remove; tools can tell you exactly which ones are problematic.

Use Verification Tools to Catch Problems Early

MailTester checks each address in your list and assigns clear verdicts: valid, invalid, catch-all, disposable, role account, or risky. For example, a result of role account means the address is associated with a generic departmental inbox, which is unlikely to engage and may be counted as a hard bounce if it doesn’t accept mail. A disposable verdict signals a temporary inbox, which will never retain your message.

You don’t have to manually scan every address. The verification API at MailTester’s real-time API lets you integrate checks directly into your customer onboarding or marketing workflows. For larger lists, bulk verification helps cleanse entire databases before you send. These tools help you isolate and remove risky addresses before they impact your deliverability.

Studies on email deliverability consistently show that low bounce rates correlate with better inbox placement. The Internet Engineering Task Force (IETF) standard for email (RFC 5322) emphasizes the importance of accurate recipient lists to maintain reliable delivery. When your list is clean, your sender reputation improves—making it more likely that your future messages reach inboxes instead of spam filters.

How MailTester Integrates with Your Workflows (Email Marketing, CRM, Apps)

You can use MailTester’s real-time API to verify email lists before sending through tools like SendGrid, Klaviyo, HubSpot, or Mailchimp—cutting bounces, improving deliverability, and protecting your sender reputation. Add verification as a pre-send step in user sign-up flows, campaign launches, or CRM syncs to catch invalid or risky addresses early. With 100 free verifications to start and credits that never expire, testing scale is low-risk and always available.

Seamless Integration with Marketing and Automation Tools

MailTester’s API works alongside your existing stack. If you’re sending bulk emails via SendGrid or running a campaign in Klaviyo, run a verification sweep first. That checks for syntax errors, disposable domains, or inactive accounts before any email leaves your server. This reduces hard bounces, avoids spam traps, and keeps your IP reputation intact—key to getting into inboxes, not junk folders.

For example, a user signs up on your website. Instead of immediately sending a welcome email, run the address through the MailTester API. If the result is “valid,” proceed. If it’s “catch-all” or “risky,” skip the send or flag it for review. This is a proven method to lower deliverability risk—according to Return Path, sender reputation has a measurable impact on inbox placement, especially with platforms like Gmail.

Use the In-App AI Assistant and Take Control of Your Data

Not all results are straightforward. A “catch-all” address might be technically valid but unengaged. A “risky” flag could mean a role-based inbox like admin@ or a high bounce history. That’s where the in-app AI assistant helps. Ask it to interpret results or explain why an address was rejected—no guesswork, just clear explanations.

Need to verify 500 emails after a new campaign launch? The bulk verification tool checks them all at once. Want to validate one address before adding to your CRM? Use the email checker. The real-time API also lets you embed validation in custom apps, syncing with your workflows automatically.

And there’s no urgency to use all credits at once—purchased credits never expire. Start with 100 free checks, then scale as needed. This flexibility means you can test workflows, audit lists, and validate new data sources without cost pressure. It’s reliability without compromise.

Best Practices for Sustaining High Deliverability with Google Workspace SMTP

To maintain high inbox placement when using Google Workspace SMTP, verify every email address before sending, warm up new sending domains gradually, enforce consistent sending patterns, and always validate your domain authentication with SPF, DKIM, and DMARC. Monitor spam complaints and feedback loops to adjust behavior in real time. Use tools like MailTester to validate your list before sending, reducing bounces and protecting your sender reputation.

Domain and IP Warm-Up

Start with low-volume sends—50–100 emails per day—over 7–10 days when launching a new domain or IP.
Increase volume slowly, only after seeing consistent inbox placement and no feedback loop reports.
Never abruptly scale up, even if results seem fine; sudden spikes trigger rate-limiting on provider side.

Authentication and Sending Discipline

Always configure SPF to include Google’s outbound servers (e.g., include:_spf.google.com) and ensure it’s not overly permissive.
Set up DKIM signing using Google Workspace’s built-in key generation—this proves message integrity.
Deploy DMARC with a policy of p=none initially, then move to p=quarantine or p=reject after monitoring reports.
Review DMARC reports via dmarc.org or third-party tools to catch unauthorized senders.
Keep daily sending volume stable per domain. Fluctuations above 3× your average can trigger throttling.
Use email verification to filter invalid, disposable, or role-based addresses before sending.
Monitor feedback loop data through providers like Microsoft SNDS or Google Postmaster Tools—respond to complaints within 24 hours.
Regularly test inbox placement with real-world inboxes using inbox placement testing to detect delivery issues early.

Final Checklist: Is Your SMTP Relay Fully Configured and Secure?

You’re good to send when your Google Workspace SMTP relay is enabled only for allowed users, your app uses port 587 with TLS on smtp-relay.gmail.com, your sending IP is whitelisted or you’re sending from within Google's network, SPF/DKIM/DMARC are active and correctly set, all recipient addresses have been validated using a tool like MailTester, and you’re not targeting role accounts, disposable domains, or known spam traps. Let’s go through each step.

SMTP & Network Layer

Confirm SMTP relay is turned on in your Google Admin Console under Apps > Google Workspace > Gmail > SMTP relay and is restricted to specific users or groups.
Ensure your application connects to smtp-relay.gmail.com on port 587 with STARTTLS enabled — no unencrypted connections allowed.
Verify your app’s outbound IP is added to the authorized IP list in Google Workspace, or you’re sending from a cloud environment integrated with Google’s internal network (like Cloud Run or App Engine).

Authentication & Email Integrity

Check that SPF, DKIM, and DMARC are published in your domain’s DNS records. Use RFC 7208 and RFC 7483 as references for correct implementations.
Double-check SPF alignment: your sending domain must be listed in the SPF record, and the sending IP must fall within the allowed range.
Ensure DKIM signs messages with a valid key hosted at your domain, and DMARC policy is set to monitor or enforce, with reports sent to a valid email address.

Even with correct SMTP setup, sending to invalid or risky addresses harms deliverability. Use a reliable verification service to catch errors early. Bulk email list verification helps identify invalid, catch-all, or disposable domains before you send.

Finally, filter out known red flags: avoid role accounts like [email protected], support@, or sales@ if not part of a targeted campaign. Steer clear of disposable domains (e.g., tempmail.org) and known spam trap networks. These can trigger filters and degrade sender reputation.

For high-volume senders, consider testing inbox placement in real mail clients. MailTester’s inbox placement tool simulates real-world delivery across Gmail, Outlook, and others.

Conclusion: Secure, Reliable Email Sending Begins with Proper Setup and Verification

Google Workspace SMTP relay configuration ensures app emails are sent securely and authenticated through a trusted infrastructure. This reduces the risk of rejection and strengthens sender reputation from the start.

Common configuration errors stem from misaligned credentials, incorrect ports, or missing TLS settings. A clear setup guide and real-time validation prevent these issues before they cause delivery failures.

Email verification isn’t optional—it’s essential. Integrating MailTester into your workflow reduces bounce rates, avoids blacklisting, and improves inbox placement by filtering invalid or risky addresses before sending.

Sources

Since May 5, 2025, Microsoft Outlook requires SPF, DKIM, and DMARC from domains sending 5,000+ emails per day, rejecting non-compliant mail outright at the SMTP level with error 550 5.7.515. — Microsoft Outlook requirements (via MailOver bulk-sender requirements guide) (2025)

Keep reading

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

Can I use Google Workspace SMTP relay without a custom domain?

No. SMTP relay requires a domain managed in Google Workspace, as authentication relies on domain-based records like SPF and DKIM.

What ports and encryption should I use for Google Workspace SMTP relay?

Use port 587 with TLS encryption. Port 25 is blocked for outbound mail in most cases due to spam filtering policies.

How many users can send via Google Workspace SMTP relay?

Only users with enabled SMTP relay access in the Admin Console can send through the relay, typically restricted to specific groups.

Do I need to set up DKIM if I use Google Workspace SMTP relay?

Yes. DKIM signing is required for full authentication and is automatically managed by Google Workspace for the configured domain.

Can my app send emails without being authenticated through Google?

No. Google Workspace SMTP relay enforces authentication via user credentials and domain-based policies. Unauthenticated sending is blocked.

How do I prevent my app from sending to role accounts?

Use a service like MailTester to identify and filter out role accounts (e.g., info@, admin@) before sending emails.

What happens if I send from an unapproved IP address?

Google will block the connection. You must add the sender IP to the allowed list in the Admin Console or use a whitelisted server.

How accurate is MailTester’s email verification?

MailTester’s verification accuracy is 98.9%—based on real-world validation across domains, catch-alls, and delivery behavior.

Do MailTester credits expire?

No. Purchased verification credits never expire, giving you flexibility in planning list hygiene efforts.

Can I integrate MailTester with my existing CRM or marketing tool?

Yes. MailTester integrates with Mailchimp, HubSpot, Klaviyo, and SendGrid—either via native connectors or API.