Gmail SMTP scan relay on legacy MFP — safe OAuth2 & app password setup

Joe B.

Expert ★★★★★ 27,853 satisfied customers

Specialities: Google Workspace, Gmail SMTP, Legacy MFPs, Networking, Scan-to-email, Mail Security

Fix legacy MFP scan-to-email with Gmail — SMTP relay, OAuth2, app passwords & 5.7.0 errors explained

Technician

Hey! We’ll get your legacy MFP scan-to-email working again with Gmail SMTP using a secure method that Google still supports.
Quick check so we pick the right fix: Are you on Google Workspace or a personal Gmail account? Which brand/model MFP or copier (Ricoh/Sharp/Canon/Xerox/HP/Konica)? And what do you currently have configured — smtp.gmail.com or smtp-relay.gmail.com, ports 465/587, any OAuth2 or app password in place, or was it using the old “less secure app” password that just stopped?

Customer

Google Workspace tenant. Old Sharp MFP that only lets us type SMTP server, port, TLS and a username/password. It used to work with basic auth and then suddenly started failing with Gmail 5.7.0 / 5.7.8 errors. No OAuth2 option.

Technician

That lines up with Google’s changes.
Google is phasing out less secure apps and plain username/password SMTP for Gmail. Legacy MFPs that only support basic auth now throw:

• 5.7.0 / 5.7.1 “Authentication Required”
• 5.7.8 Username and Password not accepted

To keep Gmail SMTP scan relay working on devices without native OAuth2, you have three safe patterns:

1. Google Workspace SMTP relay service via smtp-relay.gmail.com with IP authentication (recommended for multiple MFPs).
2. A dedicated scan mailbox using smtp.gmail.com with a secure app password (where supported).
3. For newer devices: direct OAuth2 integration with Gmail/Workspace.

We’ll choose the best option for your Sharp and stop those 5.7.x scan-to-email failures.

Customer

We have several MFPs in one office with static public IP behind a firewall. Ideally they all send scans from no-reply@ourdomain.com. What’s the correct Gmail SMTP relay setup for that?

Technician

Perfect — you’re a match for the official Gmail SMTP relay service.
Step 1 — Configure Google Workspace SMTP relay (recommended)

1. In Admin Console, go to Apps → Google Workspace → Gmail → Routing → SMTP relay service.
2. Create/adjust a relay:
   • Allow only your public static IP(s).
   • Allow only your organization’s domain (e.g. @yourdomain.com).
   • Require TLS.
3. On each legacy MFP:
   • SMTP server: smtp-relay.gmail.com
   • Port: 587 with STARTTLS (or 465 SSL if supported).
   • Authentication: None (IP-based) or as per your relay rule.
   • From address: a valid address in your domain (e.g. scan@yourdomain.com).

This keeps scans flowing without storing user passwords on old copiers and aligns with Google’s SMTP relay best practices.

Customer

One of the smaller branches isn’t on a fixed IP and only has a single legacy MFP. Can we still use Gmail securely there without buying a new device?

Technician

Yes — for a single device without static IP, use a controlled Gmail scan account with an app password (where allowed by your org policies).
Step 2 — Dedicated scan mailbox with app password

• Create or choose a mailbox like mfp-scan@yourdomain.com.
• Enable 2-Step Verification for this account.
• Generate a Gmail app password for “Mail”.
• On the MFP:
  • SMTP server: smtp.gmail.com
  • Port: 587 (STARTTLS) or 465 (SSL/TLS).
  • Username: full email address of the scan account.
  • Password: the app password, not the regular sign-in password.

This replaces the old “less secure apps” method with a modern, scoped credential that works on many legacy MFPs without OAuth2 support.

Customer

We tried that but still get 5.7.0 and 5.5.1 errors. Any common misconfigurations on copiers when using Gmail SMTP?

Technician

Great question — legacy MFP SMTP menus are sneaky.
Step 3 — Fix typical Gmail SMTP scan-to-email errors

• 5.7.0 / 5.7.8: using normal password instead of an app password, wrong port/TLS, or trying basic auth where blocked.
• 5.5.1 / 5.5.2: malformed “From” address, bad HELO, or MFP using empty sender.
• Checks:
  • Ensure TLS is enabled; many devices need “Use STARTTLS” explicitly.
  • Match From address with the authenticated account or allowed domain.
  • Disable POP-before-SMTP or odd auth modes; use plain SMTP AUTH over TLS only.

Walk through these and most Gmail SMTP relay on legacy MFP issues clear up.

Customer

Some newer devices mention OAuth2 for Office 365 but not for Gmail. Can we still do a “safe OAuth2 setup” for Gmail scan relay?

Technician

Many modern MFPs now support OAuth2 for Gmail, but it’s separate from the Office 365 profile.
Step 4 — When your MFP supports OAuth2

• In Google Cloud/Workspace, register the device/app as an OAuth client (per vendor guide).
• Grant it access to send mail as the scan account or via domain-wide delegation (admin consent).
• On the MFP, choose the “Gmail OAuth2” or “Google” profile and complete device auth.

This is the most secure option: no passwords on the panel, no app passwords, compliant with Google’s modern authentication requirements. If your current model lacks Gmail OAuth2, use the SMTP relay or app password scan account patterns above.

Customer

We’re worried about spoofing. Users want “scan from my address” but we don’t want to open relay for everyone. How do we keep it secure?

Technician

Good call — secure Gmail scan relay should respect SPF/DKIM/DMARC and avoid open relay behavior.
Step 5 — Lock down your Gmail SMTP relay on legacy MFPs

• Use a single scan identity (e.g. scan@yourdomain.com) for all devices.
• In the SMTP relay rule:
  • Restrict by IP and/or allowed senders.
  • Disallow arbitrary external “From” addresses.
• In DNS, make sure SPF includes Google; sign outbound with DKIM; enforce DMARC so mail from MFPs passes checks.
• For “scan as user”, use links (“Send me a copy”) or mailbox rules instead of letting the MFP spoof every address.

This keeps scan-to-email reliable without opening a spam gateway.

Customer

After switching one site to smtp-relay.gmail.com and another to a scan account with app password, scans work again. Any final checks to be sure this won’t break next Google update?

Technician

Final hardening checklist:

• All devices use TLS with supported ports (587/465).
• No MFP is still trying old “less secure app” basic auth with your main admin/user passwords.
• For smtp-relay.gmail.com: IP ranges and allowed senders are correct and narrow.
• For app passwords: only dedicated scan accounts, with 2FA enforced and app passwords stored securely.
• Document settings (screenshots + notes) so future admins don’t undo the secure Gmail SMTP scan relay configuration.

With this in place, your legacy MFP Gmail scan setup is both stable and compliant with Google’s modern auth policies.

Customer

That covers it — scans are sending reliably again. Thanks for helping us do it the “right” way.

Technician

Summary: To fix Gmail SMTP scan relay on legacy MFPs, stop using basic passwords, set up Google Workspace SMTP relay with IP restrictions where possible, or use a dedicated scan mailbox with an app password, and enable OAuth2 on devices that support it. Align ports, TLS, and sender addresses with Google’s requirements to eliminate 5.7.x errors.
Want us to review your exact model, Google Workspace settings, and security policies live? Open the chat.

Quick answer: the accepted fix

Accepted fix when Gmail scan-to-email stops working on legacy MFPs: use Google Workspace SMTP relay with IP restrictions for multiple devices, or configure a dedicated scan mailbox with an app password and TLS on smtp.gmail.com. Where supported, enable OAuth2. Remove old less secure app configs to prevent 5.7.x errors.

FAQ

Step-by-step: secure Gmail SMTP for legacy MFPs

1. Confirm if you use Google Workspace or personal Gmail and list all MFP models.
2. For Workspace fleets, configure SMTP relay with IP allowlists and TLS via smtp-relay.gmail.com.
3. For single devices without static IP, create a dedicated scan mailbox and use a Gmail app password over TLS.
4. Where supported, enable OAuth2 profiles for direct, passwordless Gmail authentication.
5. Test internal/external recipients, monitor for 5.7.x errors, and document all settings.

Note for mixed environments (MFPs, apps, and other devices)

1. Apply the same patterns (SMTP relay, app passwords, or OAuth2) to line-of-business apps and scanners.
2. Ensure no device is still using raw passwords with “less secure apps” to access Gmail SMTP.
3. Plan upgrades to hardware and software that support modern OAuth2 where possible.

Sources

• Google — Send email from printers, scanners, or apps (SMTP relay options)
• Google — Route outgoing SMTP relay messages through Google
• Google — Transition from less secure apps to OAuth

Matt ● replies in < 1 min

Technician Expert

⭐⭐⭐⭐⭐ Trusted by 27,000+ customers

Alex · Expert's Assistant

Start Chat

5 Tech Support Specialists are online right now.