Google Workspace SMTP relay "550 5.7.0 Mail relay denied": fix

What it means

The Google Workspace SMTP relay service (smtp-relay.gmail.com) lets your own servers, apps and devices send mail through Google. Google must first know that the connection belongs to your Workspace organization. When it cannot match the connection to your account, it refuses with a message that usually looks like this:

550-5.7.0 Mail relay denied [203.0.113.10]. Invalid credentials for
550-5.7.0 relay for one of the domains in: yourdomain.com (as obtained
550-5.7.0 from HELO and MAIL FROM). Email is being sent from a domain
550-5.7.0 or IP address which isn't registered in your Workspace account.
550-5.7.0 Please login to your Workspace account and verify that your
550-5.7.0 sending device is properly registered.

Google identifies you in two ways: by the IP address of the connection (if you listed it in the relay setting), or by SMTP authentication with a Workspace user. It then uses the domain in the HELO/EHLO greeting and in the envelope sender (MAIL FROM) to find your organization.

Why it happens

• The relay service is not configured in the Admin console, or the change has not applied yet (Google says up to 24 hours).
• The IP does not match. The setting lists one IP, but your server goes out through another one: NAT, a new VPS, a cloud provider with changing IPs, or IPv6 instead of IPv4.
• Bad HELO name. The server says EHLO localhost or an internal name such as ip-10-0-0-5.ec2.internal, so Google cannot link it to your domain. See invalid HELO/EHLO hostname.
• The sender domain is not in your Workspace account, for example an app sending as alerts@otherdomain.com.
• "Allowed senders" is too strict: "Only registered Apps users in my domains" requires the sender to be an existing user, so noreply@yourdomain.com without a mailbox fails.
• Authentication required but not sent, or sent without TLS.

This is different from a normal user logging in to smtp.gmail.com; for those login errors, see Gmail SMTP "535-5.7.8 Username and Password not accepted".

How to check

1. Find the real public IP of the sending server, from the server itself:

   curl -4 https://ifconfig.me
   curl -6 https://ifconfig.me

   If the second command returns an address, your server may connect to Google over IPv6.
2. Look at the HELO name and the exchange with Google:

   swaks --server smtp-relay.gmail.com:587 --tls \
     --ehlo mail.yourdomain.com \
     --from app@yourdomain.com --to you@example.com

3. In the Admin console, go to Apps > Google Workspace > Gmail > Routing and open the SMTP relay service setting. Compare the IP list, allowed senders and authentication options with what you found.
4. Check the sending IP on Delivmail blacklists and look up its owner with whois if you are not sure which network it belongs to.

How to fix it

1. Configure the relay setting (top-level organization, Gmail settings admin rights needed):
   • Allowed senders: "Only addresses in my domains" works for most apps and devices; it does not require a mailbox for each address. Avoid "Any addresses".
   • Authentication: check "Only accept mail from the specified IP addresses" and add your server's public IP (keep the range small), and/or "Require SMTP Authentication".
   • Check "Require TLS encryption" if your server supports TLS.
2. Use a proper HELO name that belongs to one of your Workspace domains. Postfix example:

   relayhost = [smtp-relay.gmail.com]:587
   smtp_helo_name = mail.yourdomain.com
   smtp_tls_security_level = encrypt
   # force IPv4 if only an IPv4 address is registered
   smtp_address_preference = ipv4

3. Or authenticate with a Workspace user over TLS (port 587 with STARTTLS or 465). In that case, the user's credentials identify your domain. The account needs a valid way to sign in (OAuth or app password rules apply as for normal SMTP).
4. Use a sender in your domains: set the envelope sender and From to an address on a domain that is in your Workspace account. If you must send for another domain, add it to Workspace as a secondary domain or alias domain.
5. Wait for the change to apply, then retry.

Relay through Google does not sign with your DKIM unless DKIM is turned on for the domain in Workspace; see SPF, DKIM and DMARC for Google Workspace. Your SPF must also include _spf.google.com.

Check that it is fixed

Send a message through the relay to the unique address on the Delivmail home page. If it arrives, the relay accepted you. In the report, SPF should pass for Google's servers, DKIM should be signed with your domain and DMARC should pass. Then resend the original message. If you still get a refusal mentioning relay limits instead, you have moved past this error and hit a quota.