If your organization uses Microsoft Exchange or another SMTP service or server, you can set up the SMTP relay service to route outgoing mail through Google. You can use it to:
- Filter messages for spam and viruses before they reach external recipients
- Apply email security and advanced Gmail settings to outgoing messages
Before you begin
Step 1: Set up SMTP relay in your Google Admin console
-
Sign in with an administrator account to the Google Admin console.
If you aren’t using an administrator account, you can’t access the Admin console.
-
Go to Menu
Apps > Google Workspace > Gmail > Routing.
Requires having the Gmail Settings administrator privilege.
You can add, edit, and delete the SMTP relay service setting at the top-level organization only. You can view the setting at the child organizational unit level.
- Scroll to SMTP relay service and click Configure. If the setting is already configured, click Edit or Add another.
- Enter a name for the setting and set up the following options:
Setting options What to do Allowed senders Choose an option:
- Only registered Apps users in my domains—Sender must be a Google Workspace user in one of your domains.
- Only addresses in my domains—Sender doesn't have to be a Google Workspace user, but their email address must contain your primary domain (subdomains are allowed). This option is useful when you use third-party or custom applications to send messages.
- Any addresses (not recommended)—Sender address can be any email address, including addresses outside of your domain. This option makes you more vulnerable to abuse, either by malicious software on your users' devices or by incorrect SMTP settings.
If you use the any address option and send messages from a domain that you don't own or with an empty envelope-from (for example, bounce messages or out-of-office notifications), set up your mail server to use SMTP AUTH to identify the sending domain or to present one of your domain names in the HELO or EHLO command.
If the sender is not in one of your domains, the system changes the envelope sender from user@domain_you_don't_own to postmaster@your_domain, where your_domain is the domain the system receives from SMTP AUTH or from the HELO or EHLO command.
When the address provided in the MAIL FROM SMTP command belongs to a registered Google Workspace user, that user must be assigned a Google Workspace license that allows Gmail.
Authentication Check one or both boxes to set an authentication method:
- Only accept mail from the specified IP addresses—System accepts only messages sent from IP addresses that you specify.
- Require SMTP Authentication—Enforces SMTP authentication to identify the sending domain (connection through TLS required). SMTP authentication verifies the connection by checking the user Google Workspace email address and password.
If you select the specified IP addresses option:
- Click Add.
- Enter a description and the IP address or range in IPv4 or IPv6 format.
Use your own public IP address. You can specify up to 65,536 IP addresses in one range. For security reasons, we recommend that you keep the IP range as small as possible. - Check or uncheck the Enable box to enable or disable the IP address or range.
- Click Save.
- To add more IP addresses or ranges, repeat the steps.
Encryption (Optional) To require TLS for connections between your server and Google, check the Require TLS encryption box.
Important: If your email server doesn't support TLS and you check this box, messages not sent over an encrypted TLS connection are rejected. - Click Save.
Step 2: Set up your on-premise server to point to Google
Configure Exchange servers
Expand section | Collapse all & go to top
Configure HCL, Novell, and Sendmail servers
Expand section | Collapse all & go to top
Configure macOS, Qmail, and Postfix servers
Expand section | Collapse all & go to top
Google, Google Workspace, and related marks and logos are trademarks of Google LLC. All other company and product names are trademarks of the companies with which they are associated.