Joe B.

Reviewed for technical accuracy

Specialities: MFP fax-to-email, SMTP relay (Office 365/Google Workspace), Exchange connectors, RightFax/eFax, DNS/SPF/DMARC, firewall & policy controls

Fax to email routing stuck — MFP policy issue, SMTP relay denied, scan-to-email works but fax fails, 365/Google connector, TLS/ports, size limits

Technician

Hi! We’ll get your fax-to-email routing unstuck. I’ll check three layers: MFP policy (allowed senders/domains, address book rules), SMTP relay (Office 365/Google/Exchange, TLS and ports 25/587/465), and fax routing rules on the device/server (TIFF/PDF conversion, recipient mapping). What do you see now — queued, relay denied, or delivered but no email?

Customer

From our Konica MFP, scan to email works, but fax-to-email doesn’t. Faxes land in the MFP, then the job log shows “SMTP policy blocked”. We use Microsoft 365 with a relay connector.

Technician

Got it. Common causes for fax-to-email not delivering:
1) The MFP uses a different From/sender for fax (e.g., fax@yourdomain.com) that isn’t allowed on the Exchange Online relay connector.
2) MFP policy blocks external domains or group addresses; scan profiles bypass it, but fax profiles don’t.
3) Anonymous SMTP is allowed only from a specific public IP; the device changed WAN IP or the firewall NAT is different.
4) Message fails conversion (large TIFF/PDF, unsupported multipage TIFF) and the MFP retries until the queue times out.

Customer

Logs show “550 5.7.60 Client not authenticated to send mail”. Our connector is set to accept from our static IP. The MFP’s scan uses SMTP AUTH on 587 with a service account. Fax profile says “use device SMTP”.

Technician

That explains it. Scan-to-email uses SMTP AUTH (587 STARTTLS), but fax-to-email is trying anonymous relay on 25 and hitting the connector policy.
Step 1 — Align SMTP method: set fax profile to the same authenticated SMTP as scan, or add the device’s public IP to the 365 relay connector.
Step 2 — Sender policy: use a licensed or shared mailbox like fax@yourdomain.com; restrict envelope from to your domain to satisfy SPF/DMARC and MFP policy.

Customer

If we switch fax to SMTP AUTH, do we keep the “From” as fax@, or the caller ID number gets used as sender? Also some faxes to external Gmail never arrive.

Technician

Keep a consistent From: fax@yourdomain.com and set Display Name to “Inbound Fax”. Many MFPs try to spoof the sender as the fax number; that breaks DMARC alignment and Gmail/Workspace may drop the message.
Add/confirm SPF for 365, optional DKIM, and ensure Return-Path stays on your domain. This improves deliverability to external recipients.

Customer

Attachments are TIFF. Some long faxes fail with “file too large”. Our policy limits are default. Would switching to PDF help?

Technician

Yes. Exchange Online caps at 35 MB; many devices default to 10–25 MB. Multipage TIFF can bloat. Enable PDF output with JBIG2 or MMR compression and set fax-to-email size limit to 25 MB. If using a fax server (RightFax/eFax), set per-job limits and auto-split to multiple emails.

Customer

Our firewall only allows 587 outbound. Does fax-to-email require port 25? Also the address book blocks sending to outside domains for some users.

Technician

Fax-to-email can run fully on 587 STARTTLS with SMTP AUTH — port 25 isn’t required if you aren’t doing anonymous relay.
Your MFP policy likely enforces “internal-only” for some roles. Update address book policy to permit external domains for the fax profile, or create a whitelist of destinations (e.g., billing@, pharmacy@). Keep user roles separate from device-level fax rules.

Customer

We also have a catch-all route “fax@ → shared mailbox → rule forwards to team”. Sometimes the rule doesn’t run.

Technician

Replace Outlook client rules with an Exchange transport rule (“Apply to messages to fax@ then redirect to group), which runs server-side. For Google Workspace, use a routing rule in the Admin Console.
Add a unique subject prefix (e.g., “FAX: {callerID}”) in the MFP to simplify routing. Verify that anti-phish policies don’t block auto-forwards from shared mailboxes.

Customer

After switching fax to SMTP AUTH and updating the connector, new faxes deliver. Can we make it resilient if our public IP changes?

Technician

Sure. Prefer authenticated SMTP so IP changes don’t matter. If you keep a relay on 25, use a static IP or update the connector via automation. Also confirm DNS (MX resolves correctly) and maintain SPF for 365 plus DKIM. Firmware-update the MFP; some models fix fax-to-email queue bugs.

Customer

Perfect — fax-to-email now routes to the shared mailbox and forwards to the team. Thanks!

Technician

Summary: If fax-to-email routing is stuck, align the MFP policy and SMTP relay: use SMTP AUTH on 587 or add the device IP to the 365/Google connector; lock a valid From (fax@) for SPF/DMARC; convert to PDF to avoid size errors; and use server-side routing rules. Need help standardizing across sites? Open the chat.

Quick answer: the accepted fix

Accepted fix when fax-to-email routing fails: use SMTP AUTH (587) or whitelist the device IP on your relay connector, set a compliant From (fax@) for SPF/DMARC, enable PDF attachments with sane size limits, and adjust MFP policy to allow external recipients and server-side routing.

FAQ

Step-by-step (connector, policy, routing)

1. Set fax profile to use the same SMTP AUTH (587 STARTTLS) as scan, or add the device public IP to your relay connector.
2. Lock From to fax@yourdomain.com; ensure SPF/DKIM/DMARC alignment and disable caller-ID spoofing.
3. Allow external domains in the MFP policy for fax; configure transport/routing rules to distribute.
4. Switch attachments to PDF, set sensible size limits, and update device/firmware.

Notes for mixed environments (Windows/macOS)

1. Standardize SMTP and routing settings across sites; document for both Exchange Online and Google Workspace.
2. Monitor with message trace and alert on relay denied or policy blocked events to catch future failures.

Sources

• Microsoft 365 — set up SMTP for MFPs and applications
• Google Workspace — SMTP relay & authentication options
• DMARC overview — domain alignment and policy

Matt ● replies in < 1 min

Technician Expert

⭐⭐⭐⭐⭐ Trusted by 27,000+ customers

Alex · Expert's Assistant

Start Chat

5 Tech Support Specialists are online right now.