Scan to email not working: set up a printer with Microsoft 365 or Gmail

What it means

Multifunction printers and scanners send scans by email through SMTP, like an old mail program. When it stops working, the device usually shows a vague message ("SMTP error", "authentication failed", "cannot connect to server"). Most failures come from changes on the email provider's side: stronger login rules, retired old protocols, or blocked unauthenticated mail.

Why it happens

• Password login is no longer accepted. Gmail requires an app password for SMTP, and Microsoft 365 often has SMTP AUTH turned off. See Gmail 535 5.7.8 and Microsoft 365 535 5.7.139.
• Old firmware. Devices that only support TLS 1.0/1.1 or old ciphers cannot connect to current servers.
• Wrong port or encryption. For example port 25 without login to smtp.office365.com, or SSL on 587.
• Wrong clock. A device with a wrong date fails TLS certificate checks.
• Direct send blocked. In Microsoft 365, admins can now reject unauthenticated "direct send" messages.
• Mail delivered but in spam, because the device sends as your domain from an IP not listed in SPF.

How to check

1. Note the device's settings: SMTP server, port, encryption (None, SSL/TLS, STARTTLS), username and "From" address.
2. Check the device log or error code and update its firmware.
3. Test the connection from a computer on the same network:

   nc -vz smtp.office365.com 587
   nc -vz smtp.gmail.com 587

4. Send a scan to the unique address on the Delivmail home page (works with any method that can reach external addresses). The report shows whether SPF, DKIM and DMARC pass for the device's From address.
5. On Microsoft 365, use message trace in the Exchange admin center to see whether the message arrived and why it was rejected.

How to fix it

Microsoft 365: choose one of three methods

Microsoft documents three ways for devices to send.

1. SMTP AUTH client submission (sends to anyone):

Server:     smtp.office365.com
Port:       587
Encryption: STARTTLS
Username:   scanner@yourdomain.com (a licensed mailbox)
Password:   the mailbox password

SMTP AUTH must be enabled for that mailbox. Microsoft is retiring Basic authentication (username and password) for SMTP AUTH: at the time of writing, it is planned to be disabled by default for existing tenants at the end of December 2026, with a final removal date to be announced. Check Microsoft's current timeline, and prefer a method that does not depend on it for new setups.

2. Direct send (internal recipients only, no login): the device sends to your Microsoft 365 MX host on port 25:

Server:  yourdomain-com.mail.protection.outlook.com
Port:    25
Login:   none
From:    scanner@yourdomain.com

Use the exact MX host shown by dig MX yourdomain.com +short. Your office's public IP must be static and added to SPF, otherwise scans may land in junk. If an admin turned on Set-OrganizationConfig -RejectDirectSend $true, direct send is refused and you need method 3. Direct send cannot reach external addresses, so a Delivmail test will not work with it.

3. SMTP relay with a connector (sends to anyone, no mailbox login): in the Exchange admin center, create an inbound connector from "your organization's email server" that identifies your static public IP (or a certificate). The device sends to the same MX host on port 25. Add the IP to SPF:

yourdomain.com.  TXT  "v=spf1 include:spf.protection.outlook.com ip4:203.0.113.20 -all"

See SPF, DKIM and DMARC for Microsoft 365.

Gmail and Google Workspace

• Personal Gmail or a Workspace mailbox: smtp.gmail.com, port 587 with STARTTLS (or 465 with SSL), full address as username and an app password (needs 2-Step Verification).
• Google Workspace SMTP relay: in the Admin console, configure the SMTP relay service for your office IP, then send to smtp-relay.gmail.com on port 587 (or 25/465). If you get "550 5.7.0 Mail relay denied", see Google Workspace SMTP relay denied.

If the device is too old

Update the firmware. If it still cannot do modern TLS, send through a small local relay (a server or NAS that accepts mail from the device and forwards it with proper login), or use the manufacturer's scan-to-cloud feature.

Check that it is fixed

Send a test scan to the Delivmail address (methods 1 and 3, or Gmail) and check that SPF, DKIM and DMARC pass. Then scan to a real internal and external recipient. If you changed SPF, wait for DNS propagation before testing again.