Gmail SMTP with legacy MFP — app passwords / OAuth2 relay workaround

Joe B.

Reviewed for technical accuracy

Specialities: Google Workspace, Gmail SMTP, MFP scan‑to‑email, Networking, macOS/Windows/Linux

Scan to email via Gmail — legacy MFP SMTP, app passwords, smtp.gmail.com, smtp-relay.gmail.com, OAuth2 proxy

Technician

Hey! Let’s get your Gmail SMTP scan‑to‑email working on a legacy MFP/copier (Kyocera/Ricoh/Canon/HP/Brother). Tell me if this is a personal Gmail account or Google Workspace, and whether your device supports SSL/TLS, STARTTLS, or only plain SMTP. We’ll choose between app passwords on smtp.gmail.com or a secure SMTP relay workaround (smtp-relay.gmail.com or an OAuth2 proxy).

Customer

It’s a Canon imageRUNNER that only does username/password with SSL/TLS. After Google removed “less secure apps” our scan to email fails with 535-5.7.8 Username and Password not accepted. We have Google Workspace.

Technician

Right — Google phased out basic password auth for SMTP. Your options are:
• App passwords (requires 2‑Step Verification on the sending account). Works with smtp.gmail.com on ports 465 (SSL) or 587 (STARTTLS).
• Google Workspace SMTP relay via smtp-relay.gmail.com with IP allow‑list and TLS. No OAuth on the device — the relay handles auth.
• OAuth2 relay/proxy (Postfix/msmtp “XOAUTH2” on a small Linux box or NAS) if the copier can’t meet Workspace relay requirements.
We’ll pick what matches your security policies and the MFP’s capabilities.

Customer

Let’s try the app password first. What exact SMTP settings should I enter on the MFP?

Technician

Setup with Gmail app password (Workspace or personal):
1) Enable 2‑Step Verification on the mailbox used for scanning (e.g., scanner@yourdomain.com).
2) Generate an App password (select “Mail” → “Other (Custom name)”). Copy the 16‑character code.
3) On the MFP SMTP screen enter:
• Server: smtp.gmail.com
• Port: 465 (SSL/TLS) or 587 (STARTTLS)
• Authentication: On — username = full email, password = app password
• From / Reply‑To: the same mailbox (many devices require sender = auth user).
4) Turn on Require TLS/SSL and test. This fixes most scan to Gmail failures on legacy copiers.

Customer

If we’d prefer not to use a mailbox password on the device, can we use the Workspace SMTP relay?

Technician

Yes — that’s the recommended enterprise method.
Google Workspace SMTP relay (no password on the MFP):
• In Admin console: Apps → Google Workspace → Gmail → Routing → SMTP relay service.
• Create a relay rule: Only accept from listed IPs (add your public IP), Require TLS, and Allow any sender or “Only addresses in my domains”.
• Device settings: server smtp-relay.gmail.com, port 587 (STARTTLS) or 465 (SSL/TLS). Authentication: None if IP‑based, or “Gmail/GSuite account” if you choose the auth option.
• Set a valid From address (e.g., scan@yourdomain.com) and configure SPF/DKIM/DMARC for best deliverability.
Result: the copier talks to Google’s relay with TLS; no credentials are stored on the device.

Customer

Our ISP IP changes. The relay would break when the IP rotates. Is there a workaround?

Technician

Use a small OAuth2 SMTP proxy (e.g., Postfix or msmtp on a Linux VM/NAS/Raspberry Pi). The MFP sends unauthenticated SMTP to the proxy on your LAN; the proxy authenticates to Gmail using XOAUTH2 tokens and forwards via smtp.gmail.com with TLS.
Benefits: no app password on the device, no IP allow‑listing. The proxy handles token refresh and can also throttle to avoid Gmail limits.

Customer

What about common copier brands? Any quirks when using Gmail SMTP?

Technician

Brand tips — Kyocera / Ricoh / Canon / HP / Brother:
• Enable SSL/TLS or STARTTLS and set the correct port (465/587). Some Ricoh models need “Encryption: SMTPS” to use 465.
• Use a matching sender address; many devices reject “From” ≠ auth user.
• Time sync matters — enable NTP so TLS handshakes succeed.
• If firmware only supports TLS 1.0, use the Workspace SMTP relay (it’s more forgiving) or the local OAuth2 proxy.

Customer

We still get bounces. Anything else to check for deliverability?

Technician

Verify SPF includes Google’s relay, enable DKIM for your domain, and publish a sane DMARC policy. Keep attachments under Gmail limits (25 MB) and prefer PDF. For bulk/scans to external orgs, consider rate limits and set a friendly From/Reply‑To name.

Customer

Great — can you summarize the quickest path depending on the account type?

Technician

Fast picks:
• Personal Gmail: enable 2‑Step Verification → create app password → use smtp.gmail.com (465/587).
• Google Workspace: prefer SMTP relay at smtp-relay.gmail.com with IP allow‑list + TLS. If your IP changes, use an OAuth2 proxy smarthost.
Need help choosing? Open the chat — we’ll implement the right method and test it live.

Quick answer: the accepted fix

Accepted fix for “Gmail SMTP not working on legacy MFP”: use a Gmail app password with smtp.gmail.com (port 465/587, TLS), or configure Google Workspace SMTP relay on smtp-relay.gmail.com with IP allow‑list and TLS. If neither fits, deploy a small OAuth2 SMTP proxy (Postfix/msmtp) that the copier uses as a smarthost.

FAQ

Step‑by‑step (App password method)

1. Enable 2‑Step Verification on the scanner mailbox.
2. Generate a Gmail app password and copy the 16‑character code.
3. On the MFP, set server smtp.gmail.com, port 465/587, TLS on, username = full email, password = app password.
4. Send a test email; keep the From equal to the auth account.

Step‑by‑step (Workspace SMTP relay)

1. In Admin console, configure SMTP relay service (IP allow‑list, require TLS, allowed senders).
2. On the MFP, use smtp-relay.gmail.com port 587 (STARTTLS) or 465 (SSL).
3. Set a valid sender (e.g., scan@yourdomain.com) and test to internal and external recipients.

Sources

• Google Workspace — SMTP relay service
• Google — App passwords
• Google — Send mail from a printer

Matt ● replies in < 1 min

Technician Expert

⭐⭐⭐⭐⭐ Trusted by 27,000+ customers

Alex · Expert's Assistant

Start Chat

5 Tech Support Specialists are online right now.