[ Platform guides ]
Google Workspace SMTP relay: verify application-specific authentication
Separate permission to use Google SMTP relay from the authentication that recipients observe for application mail.
By the EmailAuth research team · 4 min read
[ Key points ]
- Assign application accountability
- Validate the full relay path
- Limit relay abuse
[ Takeaway ]
Separate permission to use Google SMTP relay from the authentication that recipients observe for application mail.
[ By role ]
What this means for you
Choose your role for practical next steps.
IT / Mail Admin
Validate the full relay path
Submission and external authentication are separate gates.
Next steps
- Verify public egress and scoped relay permissions.
- Capture external headers for every application route.
- Check full diagnostic codes before changing permissions.
CISO / SecOps
Limit relay abuse
Broad relay rights can turn an application compromise into a sending incident.
Next steps
- Review sender scope and TLS requirements.
- Remove stale authorization during retirement.
- Review static-IP permissions after network changes.
Founder / Non-technical
Assign application accountability
Business jobs need delivery owners, not just a shared mail tenant.
Next steps
- Identify critical jobs and controlled test recipients.
- Plan volume increases against current limits.
- Budget for an approved alternative when volume exceeds relay scope.
[ FAQs ]
Frequently asked questions
Does a successful SMTP response prove DMARC passes?
No. It proves a submission stage succeeded; inspect the external recipient’s authentication results.
Route outgoing SMTP relay messages through Google RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)
Which IP belongs in an IP-authorized rule?
The public egress IP Google actually sees, verified with the network owner.
Should Any address be the default?
No. Select the narrowest allowed-sender scope that supports the approved application.
Can a SaaS sender skip its own setup because we use Workspace?
No. If it sends directly, configure that actual sending service.
Can I add a second SPF record for relay?
No. Maintain one applicable SPF policy at the evaluated envelope domain.
Does TLS establish DMARC alignment?
No. Transport encryption and domain alignment are separate checks.
RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)
Why test outside the tenant?
The external path exposes the final sender identities and any downstream modifications.
What should happen when the device is retired?
Remove unused relay authorization after checking for shared dependencies and preserving necessary audit evidence.
[ Sources ]
Sources
- Route outgoing SMTP relay messages through Google
Sections Before you begin · Set up SMTP relay in your Google Admin console
- Set up DKIM
Sections Generate a DKIM key · Add the DKIM key · Turn on and verify DKIM
- RFC 7208: Sender Policy Framework
Sections MAIL FROM identity · DNS lookup limits
- RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)
Sections Identifier alignment · Policy and receiver handling
[ Glossary ]
Glossary
- SMTP relay
- A service that accepts a message and sends it onward.
- Envelope sender
- The SMTP MAIL FROM identity evaluated by SPF for ordinary messages.
- Egress IP
- The public source address seen by the relay.
Enterprise provenance
Why top financial institutions and governments retired their email security dashboards.
Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.
EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.
SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption