PaperCut Mobility Print — quick on‑prem mobile printing setup

Joe B.

Reviewed for technical accuracy

Specialities: Windows 11/10, macOS (Sonoma/Ventura/Monterey), Printers, Networking, Office Equipment

Mobility Print server on‑prem for iOS/Android/Windows/Chromebook — secure, driverless BYOD printing

Technician

Hey! We’ll set up PaperCut Mobility Print on‑prem for fast, driverless printing. I’ll help you choose discovery (DNS‑SD/Bonjour or manual), open Mobility Print ports 9163/9164, install the Mobility Print server, and secure it with TLS/SSL certificate. Tell me: do you use PaperCut NG/MF today, and are clients on a single Wi‑Fi subnet or cross‑subnet VLANs?

Customer

We run PaperCut MF on Windows Server 2019 with existing print queues. Users are a mix of Windows laptops, iPhones, Android and a few Chromebooks. Wi‑Fi is separate from the print server VLAN, so mDNS/Bonjour doesn’t traverse. We want on‑prem Mobility Print only (no cloud), and we need secure BYOD printing with our own certificate.

Technician

Perfect. Here’s the quick plan for a cross‑subnet Mobility Print deployment:
• Install the Mobility Print service on the print server that hosts your queues.
• Bind it to an SSL certificate (public or internal CA) to avoid trust prompts on iOS/Android/Chrome.
• Use DNS‑SD via DNS records (recommended for routed networks) instead of pure mDNS. We’ll publish _ipps._tcp and _printer._tcp records per queue.
• Open firewall ports 9163 TCP (registration) and 9164 TCP (print data, WSS), plus 53/UDP for DNS lookups. Keep 5353 mDNS local if needed for same‑subnet discovery.
• Push the Mobility Print client for Windows, and use the Mobility Print app for iOS/Android/ChromeOS. We can also enforce User Authentication through PaperCut MF.
End result: secure driverless BYOD printing with IPPS over TLS and queue names mapped to your server.

Customer

Sounds good. Can you walk me through the step‑by‑step install for Windows Server? We’ll use our wildcard cert.

Technician

Install Mobility Print server on Windows
1) Download and run the Mobility Print installer on your PaperCut Application/Print server. Choose existing queues to share via IPPS.
2) In the setup wizard, enable User Authentication via PaperCut (locks prints to accounts; great for secure pull printing).
3) Import your SSL/TLS certificate into the Local Computer store, then in Mobility Print’s admin console select that cert for HTTPS/WSS.
4) Open firewall ports 9163/9164 TCP on the server and through any perimeter firewalls between Wi‑Fi and the server VLAN.
5) For cross‑subnet discovery, create DNS records (see next message). For same‑subnet Wi‑Fi, Bonjour/mDNS will discover automatically.

Customer

We’ll use DNS‑SD. What exact DNS records do we need to publish for each print queue?

Technician

DNS‑SD (Bonjour over DNS) for Mobility Print
Publish the following per queue in your internal DNS zone:
• _ipps._tcp.yourdomain.com SRV → target = printserver.yourdomain.com, port 9164.
• TXT record with attributes from Mobility Print (queue name, RP, TLS, Color/Mono capability). The console can export a DNS template for you.
• Optional _printer._tcp for legacy discovery. For Chromebooks, ensure IPPS and authentication flags are present.
With DNS‑SD, iOS, Android and ChromeOS will discover printers across routed VLANs without enabling multicast across subnets.

Customer

How do we handle client setup on the different platforms? We want a quick, repeatable process.

Technician

Client installation — BYOD driverless printing
• Windows 11/10: deploy the Mobility Print client via Intune/SCCM; it auto‑maps selected queues with IPPS and PaperCut authentication.
• macOS: install via pkg (MDM or manual). Users add printers from the Mobility Print dialog; queues use HTTPS and prompt for PaperCut login.
• iOS/iPadOS: install the Mobility Print app or profile; printing appears in the system share sheet as AirPrint printers (backed by IPPS).
• Android: install the Mobility Print app from Play; it exposes printers to the Android Print framework with TLS and login.
• Chromebook/ChromeOS: add printers via admin console or let devices auto‑discover via DNS‑SD and authenticate to PaperCut MF.

Customer

Any security tips? We follow Zero Trust and want to keep traffic internal to our network.

Technician

Absolutely — a few best practices for secure on‑prem Mobility Print:
• Enforce IPPS over TLS only; disable HTTP.
• Use a trusted SSL certificate (public or internal PKI) and deploy it to devices via MDM for silent trust.
• Restrict access to 9163/9164 TCP from Wi‑Fi VLANs only; block from guest networks.
• Require PaperCut user authentication and apply print policies (duplex defaults, color quotas) in MF/NG.
• Log jobs and enable Find‑Me printing with secure release on MFDs (optional).

Customer

Discovery works for iOS and Android, but Chromebooks aren’t seeing the printers yet. What should we check?

Technician

For ChromeOS, verify DNS‑SD:
• The SRV for _ipps._tcp points to your print server on port 9164 and resolves from the Chromebook VLAN.
• The TXT record includes auth and queue attributes (Mobility Print’s admin page shows expected values).
• If discovery is blocked, add printers via the Google Admin Console using the IPPS URL (ipps://printserver/queue).
• Confirm firewall rules allow TCP 9164 from ChromeOS to the server.

Customer

Everything’s online. Any tips to keep it reliable and fast? We have 500+ users.

Technician

For scale:
• Host Mobility Print on the same server as queues or a dedicated VM with enough CPU/RAM; enable service auto‑restart.
• Keep PaperCut MF/NG and Mobility Print on current versions; update the Android/iOS/ChromeOS apps periodically.
• Use DNS health checks and short TTLs for SRV records when moving queues.
• Monitor job logs and enable alerts for spooler issues; keep print drivers on the server stable.

Customer

Great — users can now print from phones and Chromebooks over IPPS. Anything else before we roll out?

Technician

Final checklist:
• Test from each platform (iOS, Android, Windows, macOS, ChromeOS).
• Confirm authentication prompts and quotas apply.
• Print a color and duplex job to verify print policy defaults.
• Document the IPPS URLs, DNS‑SD records, ports 9163/9164, and certificate expiry date.
You’re ready to deploy secure on‑prem mobile printing with PaperCut Mobility Print.

Customer

Perfect — Mobility Print works across VLANs and uses our TLS certificate. Thanks for the help!

Technician

Summary: Install the Mobility Print server, secure it with a trusted SSL certificate, publish DNS‑SD (SRV/TXT) for cross‑subnet discovery, open ports 9163/9164, and deploy client apps. This delivers on‑prem, driverless BYOD printing for iOS/Android/Windows/macOS/Chromebook through IPPS over TLS. Need hands‑on help? Open the chat.

Quick answer: the accepted setup

Accepted approach for PaperCut Mobility Print on‑prem: install the server on your print host, bind a trusted TLS certificate, publish DNS‑SD for cross‑subnet discovery (or use mDNS on same subnet), open ports 9163/9164, and deploy the client apps for BYOD driverless printing via IPPS with PaperCut authentication.

FAQ

Step‑by‑step (Windows Server)

1. Install Mobility Print server on the host with your queues.
2. Bind a trusted TLS/SSL certificate in the admin console.
3. Open firewall ports 9163/9164 TCP between Wi‑Fi and server VLANs.
4. Publish DNS‑SD SRV/TXT for _ipps._tcp (per queue).
5. Deploy client apps (Windows/macOS/iOS/Android/ChromeOS) and test IPPS.

Step‑by‑step (macOS / iOS / Android / ChromeOS)

1. Distribute the Mobility Print app/profile via MDM.
2. Ensure devices trust your certificate chain.
3. Allow discovery via DNS‑SD or add direct IPPS URLs.
4. Authenticate to PaperCut MF/NG; verify policy enforcement.

Sources

• PaperCut — Mobility Print Help Center
• Google Admin — Set up printers for ChromeOS
• Microsoft — Internet Printing Protocol (IPPS)
• Apple — Bonjour / DNS‑SD

Matt ● replies in < 1 min

Technician Expert

⭐⭐⭐⭐⭐ Trusted by 27,000+ customers

Alex · Expert's Assistant

Start Chat

5 Tech Support Specialists are online right now.