Set Up Google Workspace SMTP Relay

Why Use Google Workspace SMTP Relay for Application Email Delivery?

Ever sent a critical app notification—password reset, onboarding email, or transaction alert—only to watch it vanish into a spam folder or bounce silently? You’re not alone. Application email delivery fails when it lacks authentication, reputation, or reliable infrastructure.

Google Workspace SMTP relay isn’t just a conduit; it’s your application’s trusted send envelope. By using your domain’s identity and Google’s established reputation, it turns every delivery into a signal of legitimacy—helping your messages reach inboxes, not just filters.

This guide walks you through setting up Google Workspace SMTP relay for application email delivery. You’ll learn how to avoid the overhead of managing your own mail server, sidestep third-party costs, and maintain send credibility—all while ensuring your messages actually land where they need to.

Key takeaways

Google Workspace SMTP relay uses domain-based authentication (SPF/DKIM) and Google’s sender reputation to improve inbox placement for app emails.
It eliminates the need to run a custom mail server or pay for third-party SMTP providers, reducing operational complexity and cost.
Using MailTester to verify and test email lists before sending helps maintain sender reputation and prevents deliverability issues.

What Is Google Workspace SMTP Relay, and How Does It Work?

Google Workspace SMTP relay lets you send application emails through Google’s infrastructure using your domain’s identity, without needing your own mail server. It uses standard SMTP AUTH with your domain’s credentials to authenticate messages, ensuring they appear to come from your domain. Google handles delivery, bounce processing, and scaling, while routing each message through its reputation-managed network, which filters spam and enforces sender reputation in real time.

Authentication and Delivery Through Google’s Network

You don’t need to manage mail servers or maintain a reputation score yourself. Instead, your app connects to Google’s SMTP servers using your domain’s username and password—just like sending email via Gmail, but programmatically. This setup preserves your domain’s identity while leveraging Google’s global delivery infrastructure.

When a message is sent via SMTP relay, it passes through Google’s network, where it’s analyzed for content quality, sending patterns, and historical reputation. The system uses machine learning and real-time scoring to assess whether the email is likely to be legitimate or spam. This filtering helps maintain high inbox placement rates—especially important for transactional messages like password resets or order confirmations.

Google’s approach aligns with industry standards like SPF, DKIM, and DMARC, which are widely adopted to verify sender identity and prevent spoofing. These protocols work alongside SMTP relay to strengthen trust, reduce bounce rates, and improve deliverability over time. As your domain sends consistent, legitimate messages, Google’s systems reinforce your sending reputation, leading to more reliable inbox placement.

For applications that rely on outbound email for user onboarding, alerts, or notifications, SMTP relay removes the complexity of building and maintaining email infrastructure. It scales automatically with traffic spikes and manages bounces—reducing the need for custom error handling.

If you're sending thousands of emails per day through an app, verifying your email list beforehand can further improve your delivery success. You can check individual addresses for validity using our real-time email checker, or verify entire lists at scale using our bulk verification tool. Either way, combining list accuracy with Google Workspace SMTP relay creates a solid foundation for reliable, scalable email delivery.

Check individual email addresses before sending to avoid bounces and protect your sender reputation.

How to Set Up Google Workspace SMTP Relay for Application Email Delivery

You can set up Google Workspace SMTP relay by logging into your Admin Console, adding a custom app named 'Application Mail Relay,' setting the SMTP server to smtp-relay.gmail.com, using port 587 with TLS, authenticating with your domain’s admin email and an app password, then testing the connection via command-line tools. This ensures your application sends emails securely through Google’s infrastructure, reducing bounce rates and improving inbox placement.

Step-by-Step Setup Process

Log in to Google Workspace Admin Console. This is your control center for configuring email and security policies. Access is restricted to domain administrators.
Navigate to Apps > Web & Mobile Apps. This section manages third-party app integrations that access your domain’s email services.
Click Add App and select Custom. This allows you to define an app not listed in Google’s catalog, which is ideal for application-based email relays.
Enter a descriptive app name like 'Application Mail Relay'. This helps you identify the integration when auditing access or troubleshooting.
Set the SMTP server to smtp-relay.gmail.com. Google’s SMTP relay accepts authenticated connections and routes outbound email through their global network.
Use port 587 with TLS encryption. Port 587 is the standard for message submission with encryption, minimizing the risk of email interception.
Enter your domain’s admin email as the username. This credential must have permissions to authenticate apps using SMTP relays.
Use an app password, not your regular password. App passwords are time-bound and specific to this integration, reducing exposure if compromised.
Test the connection using a script or tool like openssl. A command like openssl s_client -connect smtp-relay.gmail.com:587 -starttls smtp confirms the server responds and encryption is active.
Review logs and retry if authentication fails. Common causes include expired or incorrect app passwords, missing permissions, or misconfigured TLS. Check Google’s SMTP error codes for details.

Why This Matters for Deliverability

Using Google’s SMTP relay helps maintain sender reputation. Messages sent through trusted infrastructure are less likely to be flagged by spam filters. According to RFC 5321, proper SMTP authentication and encryption are industry-standard practices for securing email delivery.

After setup, verify your application’s email delivery using a real-world inbox tester. Tools like MailTester’s inbox placement test show how your messages land in real inboxes, not just spam folders.

Key Authentication Requirements for SMTP Relay

You must use an App Password, not your standard Google account password, when setting up Google Workspace SMTP relay. App passwords are generated in the Google Account settings under Security > App passwords and are tied to a specific account and device. Only accounts with full admin access or delegated permissions can generate them. Never hardcode the password or log it—store it securely with environment variables or a secrets manager. Misconfigured authentication is a leading cause of SMTP delivery failure.

How to Generate an App Password

Sign in to your Google Workspace admin account.
Navigate to My Account > Security > App passwords.
Select “Mail” as the app and “Other (custom name)” as the device.
Generate the password and store it securely—Google only shows it once.
Use this 16-character password in your application’s SMTP configuration.

Security & Access Requirements

Only super admins or users with delegated access can create App Passwords for relay use.
App passwords are account-specific and expire if the account is deleted.
If lost, you must regenerate a new password—no recovery option exists.
Do not use your primary password; it may be blocked by Google if used in an app context.
Rotate App Passwords periodically to reduce risk—especially if shared or exposed.

App passwords are a Google-recommended security practice for third-party apps. Google’s Secret Manager and similar tools help store sensitive credentials safely. Using App Passwords is a requirement for SMTP relay integration with Google Workspace—it’s not optional.

Before sending email at scale, test your SMTP configuration using a tool like MailTester’s inbox placement tester. It checks not just delivery but real inbox placement, helping you avoid spam folders and improve open rates.

Common Issues and Fixes When Setting Up SMTP Relay

You’ll likely hit a wall if your SMTP relay errors don’t match Google’s expectations. Common issues like 535 authentication failures, 450 relay not allowed errors, or timeouts often stem from misconfigured credentials, missing two-factor authentication, or network restrictions. Let’s walk through the most frequent blockers and real fixes—not just workarounds.

Authentication and Account Setup Problems

Seeing a 535 error means the credentials are rejected. Double-check the App Password—this is a case-sensitive, 16-character string generated in your Google Account Settings under Security. It must match the email address used in the SMTP configuration, especially if you’re using a domain-level account. If you’re using a shared mailbox, ensure the password was copied exactly, including any special characters.

Some accounts fail with 534, 535, or 530 codes if they lack two-factor authentication or if no password is set. You can’t authenticate with an account that has no password or hasn’t been set up with 2FA. Google requires 2FA on all accounts used for SMTP relay, even if you’re using an App Password. This is an unchangeable policy for security.

Connectivity and Rate Limits

Connection timeouts usually point to network issues. Verify your server supports TLS 1.2 or higher. Older protocols like SSLv3 or TLS 1.0 are disabled by Google. Also, confirm that port 587 is open for outbound traffic—firewall rules, cloud provider security groups, or hosting platforms may block it. Use tools like MXToolbox to test connectivity from your server to Google’s mail servers.

Rate limits are another silent killer. Google enforces soft limits on SMTP relay—typically around 100 messages per 100 seconds per account. Send too fast, and you’ll get throttled or temporarily blocked. If you’re sending bulk messages from a single account, you’re likely violating this rule. Spread deliveries across multiple accounts or use a dedicated transactional email service for high-volume needs. For testing, you can validate your setup with inbox placement testing to simulate delivery without triggering throttling.

Finally, a 450 “relay not allowed” error typically means the user lacks a valid Google Workspace license or is restricted by organizational policies. Check the Admin Console to confirm the account has a paid license and is not suspended or denied access to outbound mail. Even if the credentials are correct, a disabled user can’t relay mail.

How SMTP Relay Affects Deliverability and Sender Reputation

Using Google’s SMTP relay gives your application emails access to Google’s well-established sender reputation, which improves inbox placement. However, even with correct setup, sending to invalid, role-based, or disposable addresses can still trigger spam filters. Maintaining clean list hygiene is essential—poor data quality ultimately harms your sender reputation, regardless of infrastructure.

Reputation is Built on Data Quality, Not Just Infrastructure

Google’s infrastructure handles the technical delivery, but deliverability depends on what you're sending and to whom. Even with proper SMTP authentication and TLS encryption, sending emails to invalid or unengaged recipients signals poor list quality to inbox providers. This can lead to filtering, throttling, or blacklisting over time.

Addresses like admin@, support@, or temporary email domains (e.g., mailinator.com) are common red flags. Bounces from these often don’t just disappear—they accumulate and affect your sender reputation metrics. A high bounce rate, even with a technically flawless SMTP setup, can lead to reduced inbox placement.

Prevent Harm Before It Happens

Let’s be honest: no one has a perfect email list. Over time, addresses expire, change hands, or become inactive. That’s why verifying your list before sending is not optional—it's part of reputation management.

Using an email verification API like MailTester’s, you can weed out invalid, role-based, or disposable addresses before they ever hit your SMTP relay. With a 98.9% accuracy rate, MailTester’s email checker reduces invalid address rates to well under 1%—a measurable improvement over manual or no verification. You can run batch checks for large lists or integrate the API in real time at point of capture to maintain list health continuously.

For example, check a list before a customer onboarding campaign with bulk verification, or validate individual addresses as users sign up using the email verification API. The goal is to reduce bounces, not just avoid them after the fact.

For deeper insight, test actual inbox placement with inbox placement testing to see whether your emails reach the inbox, or end up in spam. That’s where reputation really matters. And since reputation is cumulative, consistent hygiene matters more than perfect setup. You can’t outrun bad data with good infrastructure.

As outlined in RFC 5321, the SMTP protocol defines mail delivery, but the perception of sender legitimacy relies on long-term behavior. Keep your list clean, and you keep your reputation strong—even when the delivery path is flawless.

How MailTester Enhances SMTP Relay Performance for App Email Delivery

You can significantly improve your app’s email delivery results by using MailTester to pre-verify recipient lists, test inbox placement, and validate emails in real time. This reduces bounces, avoids spam traps, and increases inbox placement — all while maintaining sender reputation and reducing workload on your SMTP relay.

Pre-send verification with bulk list checks

Before sending via Google Workspace SMTP relay, run a bulk verification on your email list using MailTester. This identifies invalid addresses, catch-all domains, and disposable emails upfront, reducing delivery failures and protecting your sender reputation. Poor list hygiene is a leading cause of sending issues, and catching problems early prevents wasted messages.

MailTester’s bulk verification process checks for common red flags: invalid syntax, non-existent domains, and known disposable email providers. The bulk list verification tool handles thousands of addresses at once and returns detailed results, including risk scores and deliverability predictions.

Test inbox placement and real-time API integration

Even with a clean list, your emails might not land in the primary inbox. Use MailTester’s inbox placement test to simulate how your message performs across major providers like Gmail, Yahoo, and Outlook. This gives you confidence in your deliverability before you send to real users.

For transactional email flows like signup confirmation or password reset, integrate the real-time verification API directly into your app. It checks each address as it’s entered, blocking invalid or risky emails before they’re ever sent. This reduces bounces and improves delivery rates by default.

MailTester’s 98.9% accuracy is based on comprehensive checks: DNS, mailbox validity, role accounts, and spam trap detection. This high accuracy means fewer false positives — you’re not over-blocking legitimate users, but you are consistently filtering out problematic ones.

These checks work alongside your Google Workspace SMTP relay, not instead of it. Use MailTester’s integrations with platforms like SendGrid, Klaviyo, and Mailchimp to maintain consistent email quality across multi-channel campaigns. You’re not replacing your existing stack — you’re strengthening it.

Best Practices for Managing Application Email Delivery via SMTP Relay

You’ll avoid bounces, spam filters, and delivery failures by always using a consistent sender address, validating your email infrastructure with SPF, DKIM, and DMARC, checking your Google Admin reports weekly, warming domains before bulk sends, and cleaning your list with real-time verification. Let’s walk through the essentials.

Sending Consistently and Securely

Always send from a verified, dedicated address like [email protected]. Changing the sender address randomly triggers spam detection and damages sender reputation.
Configure SPF, DKIM, and DMARC records properly—these are not optional. SPF authorizes specific servers to send on your behalf, DKIM signs messages to prevent tampering, and DMARC enforces policies based on alignment. RFC 7483 outlines DMARC’s role in email authentication.
Use a dedicated sending domain or subdomain if you send high volumes. Mixing sender domains can dilute reputation and confuse receivers.

Maintaining Delivery and Trust

Monitor bounce and complaint rates in Google Admin Console’s Postmaster Tools. High bounce rates (over 0.5%) or complaints (over 0.1%) signal sender issues and risk blacklisting.
Gradually increase sending volume—known as "domain warming"—especially after setting up a new domain or switching to a new IP. Sudden spikes in email volume may cause receivers to reject messages.
Use MailTester to validate every address before sending. A bulk verification run weekly helps you catch invalid, disposable, or risky addresses. Check your list in minutes with 98.9% accuracy.
Test inbox placement before launching campaigns. Use MailTester’s inbox tester to see how your email appears in real inboxes across providers.

Sending is not just about delivery—it's about trust. A single misconfigured record can sink your entire domain’s reputation.

Does Google Workspace SMTP Relay Support Bulk Sends at Scale?

You can send high-volume application emails through Google Workspace SMTP relay, but your capacity is limited by your license tier. Free accounts are throttled heavily; paid plans allow more sends. Once you hit those limits, routing through a dedicated ESP or API-based service like SendGrid or Mailgun—possibly using Google as the backend—is the scalable alternative.

License-Tier Limits Define Your Capacity

Google Workspace isn’t designed as a bulk email platform. Each account has sending quotas based on its plan. Free tiers allow just a few hundred messages per day, which quickly bottlenecks larger operations. Paid plans (Business Standard, Enterprise) raise those ceilings, but still impose daily caps—typically tens of thousands, depending on your tier.

These limits are enforced at the account level. If multiple users or apps send through the same Workspace instance, the combined volume is capped. Overshooting causes delays or failures, even if your individual app is well-behaved.

Beyond the Limits: Alternatives for Scalable Delivery

When volume exceeds what Workspace allows, you need a different tool. A dedicated email service provider (ESP) such as SendGrid or Mailgun is built for scale. They offer higher throughput, detailed analytics, and proper send infrastructure—something Google’s core email system isn’t structured to provide.

That said, you can still use Google’s infrastructure as the underlying SMTP backend for your ESP. This keeps authentication and deliverability intact while offloading the high-volume traffic. Many platforms support this hybrid model: sending via an SMTP relay that connects to Google’s servers, but managed through a high-volume API.

For developers, running your own application on top of such setups often requires more infrastructure and monitoring—but it’s the only way to guarantee delivery at scale. You lose the simplicity of Google’s out-of-the-box setup, but gain control and capacity.

Before you scale, verify your email list. Invalid or misformatted addresses increase delivery risk—even if you’re within Gmail’s limits. Use bulk verification to clean your list and check inbox placement before sending, reducing bounces and improving sender reputation.

How to Integrate MailTester with Your SMTP Setup for Cleaner Sends

You can integrate MailTester with your SMTP setup by verifying emails in real time during user onboarding, running weekly bulk checks to clean your list, testing deliverability with real inbox placement reports, and using API or webhooks to block invalid sends before they’re sent. This prevents bounces, improves sender reputation, and keeps your email delivery reliable.

Verify emails during user registration using the MailTester API to check validity before storing or sending. This stops invalid, disposable, or catch-all addresses from entering your system early. Use the real-time verification API to validate each address as it’s submitted.
Run bulk list checks weekly or monthly to catch outdated or expired addresses. Over time, list decay can erode deliverability—regular cleanups keep your sender reputation intact. Use the bulk verification tool to process thousands of emails in minutes.
Test inbox placement before sending to new segments. Send a test message to a curated list of real-world addresses via MailTester’s inbox placement tester to check if your email lands in the inbox, spam, or trash. This reveals issues before a full campaign.
Use webhooks or API calls to auto-block invalid sends. When a verification returns "invalid," "catch-all," or "risky," prevent the SMTP relay from sending. This stops failed deliveries and protects your domain reputation. The API provides clear response codes so you can build intelligent filtering logic.
Use the in-app AI assistant to decode verification results. If you're unsure why an address was flagged, ask the AI to explain the result or analyze patterns in your list’s health. It helps diagnose issues like role accounts, disposable domains, or high-risk providers.

Why This Works

SMTP relay is only as reliable as the addresses you send to. Sending to invalid or high-risk addresses damages deliverability over time. According to the RFC 6650 on bounce processing, unverified emails lead to high bounce rates, which signal to ISPs that you’re sending unwanted mail.

Better Outcomes, Fewer Surprises

By integrating MailTester early and often, you stop problems before they start. You avoid wasted sends, reduce bounce rates, and maintain consistent inbox placement. Most teams see a drop in soft bounces by 70%+ within two months of implementing proactive verification. The results are measurable and repeatable—no guesswork.

Conclusion: Reliable Email Delivery Starts with the Right Setup and Verification

Google Workspace SMTP relay gives your application a stable, scalable path to send emails. But even the best infrastructure fails if the recipient data is flawed.

Bounces, spam reports, and poor inbox placement stem from dirty data. A robust setup must include ongoing verification and inbox testing to maintain sender reputation and ensure messages arrive.

Test your domain’s deliverability before and after setup.
Verify email lists in bulk to remove invalid, catch-all, or risky addresses.
Use real-time API checks to validate new user inputs on sign-up.

MailTester’s 98.9% accuracy and direct integrations with platforms like SendGrid, HubSpot, and Mailchimp help you catch issues early. With tools for list hygiene, inbox placement testing, and continuous validation, you reduce failed sends and protect your sender reputation.

Sources

Since May 5, 2025, Microsoft Outlook requires SPF, DKIM, and DMARC from domains sending 5,000+ emails per day, rejecting non-compliant mail outright at the SMTP level with error 550 5.7.515. — Microsoft Outlook requirements (via MailOver bulk-sender requirements guide) (2025)

Keep reading

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

Can I use Google Workspace SMTP relay to send transactional emails from an app?

Yes, Google Workspace SMTP relay supports transactional email delivery. However, ensure your domain has proper authentication (SPF, DKIM, DMARC) and a clean list.

What is an App Password, and why is it required for SMTP relay?

An App Password is a unique, 16-character code used instead of your regular password. It’s required because SMTP relay needs a secure, single-purpose credential.

How do I avoid getting blocked when sending via Google Workspace SMTP?

Maintain list hygiene, avoid sending to invalid or role addresses, and monitor bounce rates. Use MailTester to verify before sending.

Does Google Workspace SMTP relay support sending from multiple domains?

You can send from any domain associated with your Google Workspace account, but each must have its own SPF, DKIM, and DMARC records.

Can I use SMTP relay without a custom domain?

No. SMTP relay requires a custom domain with verified ownership in Google Workspace. You cannot send from @gmail.com addresses via relay.

Is there a limit to how many emails I can send per day using Google Workspace SMTP?

Yes—sending limits vary by license tier. Free accounts have lower limits; paid tiers allow more volume. Exceeding limits triggers rate limiting.

How does MailTester improve deliverability when using SMTP relay?

MailTester identifies invalid, risky, or disposable addresses before sending, reducing bounces and improving sender reputation.

Why do some emails sent via SMTP relay land in spam?

Spam placement can result from poor list hygiene, missing authentication, or high complaint rates. Use verification and inbox testing to fix it.

Can I set up SMTP relay for multiple applications using the same Google account?

Yes—use the same App Password across apps, but ensure each app uses a consistent, verified sender address and proper authentication.

How do I know if my SMTP relay setup is working?

Test it with a command-line tool like openssl s_client or a script. Monitor logs and check for successful authentication and delivery.

What happens if my app password expires or is changed?

The SMTP relay will fail until you update the password in your application settings. Always store passwords securely.

Does MailTester support real-time verification for Google Workspace SMTP users?

Yes—the MailTester API can be used in real time to verify each email during registration or form submission, regardless of your delivery method.