SMTP Relay: Services, Google Setup, DNS

What is an SMTP relay?

An SMTP relay is a mail server that takes a message from a client and forwards it to another server, usually the recipient's MX host. It runs on SMTP, the Simple Mail Transfer Protocol, which the IETF publishes as an open standard. The client could be a CRM, a website contact form, a printer that scans to email, or a sales tool. The client doesn't deliver mail to the internet itself. It hands each message to the relay, and the relay takes care of DNS lookups, retries and bounces.

Here's an example. Your web shop sends an order confirmation from orders@yourdomain.com. The shop server connects to your relay's submission port, authenticates and submits the message. The relay looks up the MX record of the buyer's domain, opens a server-to-server SMTP connection to that host and delivers. If the receiving server is busy and sends back a temporary failure code, the relay queues the message and tries again later. Your shop never has to handle any of that.

Next, the receiving server checks whether the relay is allowed to send for yourdomain.com. This is the check most setups get wrong. The DNS section further down covers it.

How does an SMTP relay work, step by step?

1. 1 Submission: the client connects to the relay's submission port. The relay's setup page lists it, alongside an implicit-TLS port on many services. Server-to-server delivery uses a separate port.
2. 2 Encryption: on the submission port, the client sends the STARTTLS command. This upgrades the connection to TLS before any credentials are sent.
3. 3 Authentication: the client logs in with SMTP AUTH, using a username and password or API-key credentials. Alternatively, the relay accepts the connection because it comes from a registered IP address.
4. 4 Envelope and message: the client sends MAIL FROM, RCPT TO for each recipient, and DATA with the headers and body. The MAIL FROM address is the envelope sender, and it becomes the Return-Path.
5. 5 Signing: the relay adds a DKIM signature. Ideally the d= value is your own domain.
6. 6 Delivery: the relay looks up the MX record of the recipient's domain and delivers. Temporary failures are queued and retried. Permanent failures produce a bounce message.

Step three is what separates a relay from an open relay. An open relay accepts mail from anyone and sends it anywhere. The SMTP standard's security considerations name this as a risk. Spammers find open relays quickly, and the relay's IP then ends up on DNS blocklists. Every service in the next section requires authentication or an IP allowlist.

What is an SMTP relay service, and which ones exist?

An SMTP relay service is a hosted relay. You get a hostname, a port and credentials, and the provider runs the sending infrastructure. Google Workspace, Amazon SES, Brevo, Mailgun, Mailjet, MailerSend, SMTP2GO and SocketLabs all publish SMTP relay documentation. The protocol is the same everywhere. What differs is who each service is built for and what its acceptable use policy allows. The table compares the services on the same properties, based on each vendor's own documentation.

Service	Built for	How you authenticate	Where it stops
Google Workspace SMTP relay	Devices and apps in an organisation that already uses Workspace mail	Registered IP addresses, SMTP AUTH with a Workspace account, or both (Google Workspace Admin Help)	Only Workspace customers can use it, and the admin decides which sender addresses are allowed
Amazon SES SMTP interface	Developers and apps already running on AWS	SES-specific SMTP credentials created in the SES console. These are separate from AWS access keys (Amazon SES Developer Guide)	New accounts start in a sandbox. Until production access is granted, they can only send to verified addresses
Brevo SMTP relay	Marketing and transactional senders who want campaign tools in the same account	An SMTP login and key from the SMTP settings of the Brevo account	Sending is governed by Brevo's acceptable use policy and the account's plan
Mailgun, Mailjet, MailerSend, SMTP2GO, SocketLabs	Transactional mail from apps, such as receipts, password resets and notifications	SMTP credentials or API keys per domain, as described in each vendor's docs	Each vendor's acceptable use policy has rules on unsolicited mail. Read it before you use the service for outreach

For your sender reputation, the key question is whether the service signs with your domain and lets you set a custom Return-Path on a subdomain you own. If it does, reputation builds up under your domain. If it doesn't, the receiving server sees the provider's domain instead.

Google SMTP relay: how does the Workspace service work?

Google SMTP relay is a Workspace feature that lets an administrator send outgoing mail from devices and apps through Google's servers. Google documents it in Workspace Admin Help, in the article "Route outgoing SMTP relay messages through Google". In the Admin console, go to Apps > Google Workspace > Gmail > Routing and open the SMTP relay service setting. You configure three things there:

• Allowed senders: only registered Workspace users, only addresses in your domains, or any address.
• Authentication: accept mail only from specified IP addresses, require SMTP authentication with a Workspace account, or require both.
• Encryption: require TLS for the connection.

Clients connect to smtp-relay.gmail.com on one of the ports listed in that Admin Help article. A common failure is a printer or app that connects from a dynamic IP that was never registered. Google rejects the mail, and the device shows only a generic send error. Mail sent through the relay counts toward Google's relay sending limits, which are separate from per-user limits. Our guide to Gmail sending limits explains how those quotas and the bounce errors they cause work. Your SPF record also needs include:_spf.google.com. Without it, relayed mail fails SPF.

Can I use Gmail as an SMTP relay service?

A personal Gmail account doesn't include the Workspace relay service. It does have an outgoing SMTP server, smtp.gmail.com, and an email client or script can log in to it with the account's credentials. According to Google Account Help, apps that don't support Google sign-in need an app password, and app passwords only work after two-step verification is turned on. That makes smtp.gmail.com a submission server for one mailbox, not a relay for an office or an application. Every message goes out as that one account and counts against that account's sending limits.

That's fine for a script that sends you alerts. It doesn't work for mail from your company domain. A gmail.com account can't sign DKIM for yourdomain.com, so DMARC on your domain can't align. To send from your own domain through Google, you need a Workspace subscription and smtp-relay.gmail.com. Our guide to Google Workspace DNS records covers the DNS side.

Is there a free SMTP relay service?

Several transactional providers offer free tiers or trial allowances. The caps vary by vendor and change over time, so we don't quote them here. Check each vendor's pricing page on the day you sign up. When you compare free options, look at the points below. They decide whether a free tier is usable at all and what you'll pay once you outgrow it:

• Volume caps per day or per month. Messages over the cap are usually rejected or held in a queue, not delivered.
• Custom-domain DKIM signing and a custom Return-Path. Check whether the free tier includes them or only the paid plans do.
• Shared or dedicated IPs. Free tiers usually send from shared pools, so other senders' behaviour affects the reputation of the IP.
• Log retention and bounce webhooks. You need them to remove hard bounces before your next send.
• The acceptable use policy. It's the same for free and paid accounts and usually has rules on unsolicited mail.

Running your own Postfix server costs nothing in licences, but you take on the work: reverse DNS, TLS certificates, queue monitoring and blocklist checks. Many cloud providers block outbound server-to-server SMTP traffic on new instances by default. Until the provider lifts that block, a self-hosted relay often can't deliver anything.

Which DNS records does an SMTP relay need?

The receiving server decides whether to accept relayed mail, and the first thing it checks is your DNS. Each record involved, and how it typically fails:

Record	What it does for relayed mail	Typical failure
SPF (TXT at the root or the Return-Path domain)	Authorises the relay's IPs to send for the envelope domain	The relay's include is missing, or someone adds a second SPF record. The SPF specification treats more than one SPF record as a permanent error (permerror)
DKIM (TXT or CNAME at selector._domainkey)	Lets the relay sign with d=yourdomain.com	The relay signs with its own domain. DKIM passes but doesn't align with your From domain
DMARC (TXT at _dmarc)	Requires SPF or DKIM to pass and to align with the From domain, as the DMARC specification defines	Both checks pass on the provider's domain, neither aligns with yours, and DMARC fails
Custom Return-Path (CNAME)	Moves the envelope sender onto your subdomain so SPF can align	It isn't set up, so bounces and the SPF check go to the provider's domain

Once you've changed your DNS, send a test message and check the Authentication-Results header. You're looking for spf=pass, dkim=pass with your own domain in header.d, and dmarc=pass. Our SPF, DKIM and DMARC checker queries the records you've published. The guide to DKIM, DMARC and SPF for cold email senders goes into alignment in more depth.

How EmailFlow OS sends: from your own Brevo account and domain

Video outreach with EmailFlow OS, a EmailFlow OS product, doesn't go through a shared platform sender. You record one video and upload it to EmailFlow OS. You connect your own Brevo account and your sending domain. Then you import your prospect list into EmailFlow OS, and that's where the list lives. EmailFlow OS creates a personalised version of the one recording for each recipient, not one per company. Each version goes out from your own inbox, through your Brevo account and your sending domain.

Your SPF, DKIM and DMARC records, your domain's reputation and your Brevo account all stay under your control. That also means the DNS work described above is still yours to do. The receiving server decides whether to accept each message and which folder it goes into. The page about personalised AI video email from EmailFlow OS shows how the workflow fits together.

Questions people ask

? Which port should I use for an SMTP relay?

Use the relay's submission port with STARTTLS, or its implicit-TLS port if your client only supports that. The server-to-server port is for delivery between mail servers, and many cloud networks and ISPs block it for outbound traffic. Each service lists its ports on its own setup page. Google lists them in Workspace Admin Help and Amazon in the SES Developer Guide.

? What is the difference between an SMTP relay and an open relay?

An SMTP relay forwards mail only from clients that log in with SMTP AUTH or connect from an allowlisted IP. An open relay forwards mail from anyone to any destination. Spammers look for open relays, and the relays' IPs end up on DNS blocklists. That's why every hosted relay service requires credentials or registered IPs.

? Does an SMTP relay service improve deliverability?

A relay doesn't decide where a message ends up. The receiving server does. The relay queues messages, retries them and reports bounces. The receiving server weighs SPF and DKIM alignment with your From domain, your domain's reputation, complaints and list quality. A relay that signs with its own domain instead of yours can cause DMARC to fail.

? Can I use a transactional SMTP relay for cold email?

Read the provider's acceptable use policy first. Transactional services such as Amazon SES, Mailgun and Mailjet publish rules on unsolicited mail, and breaking them can get your account suspended. In the EU, consent rules such as those in Germany's UWG also apply, whichever relay you use. Find out what your outreach requires before you send.