{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/google-workspace-device-smtp-relay-boundaries/", "item": { "id": "https://update.dsesecurity.com/updates/google-workspace-device-smtp-relay-boundaries/", "slug": "google-workspace-device-smtp-relay-boundaries", "url": "https://update.dsesecurity.com/updates/google-workspace-device-smtp-relay-boundaries/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/google-workspace-device-smtp-relay-boundaries.md", "json": "https://update.dsesecurity.com/api/v1/posts/google-workspace-device-smtp-relay-boundaries/" }, "title": "Constrain Google Workspace SMTP relay for device alerts", "summary": "Scope senders, public egress addresses, and TLS requirements before routing device notifications through Google Workspace.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-15T00:43:30+00:00", "modified_at": "2026-10-15T00:44:33+00:00", "reviewed_on": "2026-10-14", "reading_minutes": 2, "word_count": 263, "potentially_affected": "Use this for an approved Google Workspace relay design for on-premises devices or applications. Verify account eligibility, the selected authentication method, and each device’s supported TLS behavior.", "dse_recommendation": "DSE recommends listing the devices, approved sender addresses, public egress paths, relay owner, and alert recipients before configuration.", "primary_source": { "name": "Google Workspace Admin Help — Route outgoing SMTP relay messages through Google", "url": "https://knowledge.workspace.google.com/admin/gmail/advanced/route-outgoing-smtp-relay-messages-through-google?hl=en", "published_on": null, "authority": "knowledge.workspace.google.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Scope senders, public egress addresses, and TLS requirements before routing device notifications through Google Workspace.

\n

Source facts

\n

Google’s SMTP relay documentation offers separate controls for allowed senders, authentication, and TLS. Administrators can restrict sending to specified public IP addresses and can require TLS, rejecting connections that do not use it. Sender choices include registered users or addresses in the organization’s domains; Google does not recommend allowing any address indiscriminately. The relevant IP range is the sending system’s public egress, not simply its private LAN address.

\n

Source: Google Workspace Admin Help — Route outgoing SMTP relay messages through Google.

\n

Applicability

\n

Use this for an approved Google Workspace relay design for on-premises devices or applications. Verify account eligibility, the selected authentication method, and each device’s supported TLS behavior.

\n

DSE recommendation

\n

DSE recommends listing the devices, approved sender addresses, public egress paths, relay owner, and alert recipients before configuration. Use the smallest justified source range and an allowed-sender policy that matches the actual workflow. Plan for an ISP or firewall change that alters egress addressing. Keep notification tests separate from production alarms so a troubleshooting exercise cannot be mistaken for a real incident. Record how delivery failures reach the administrator responsible for the device.

\n

Verification

\n

Send a labeled test notification and confirm receipt and relay logs. Under controlled conditions, verify rejection from an unauthorized source or sender and validate the required TLS behavior. Retain sanitized delivery evidence; a successful test does not guarantee future delivery of every alert.

\n

Official reference

\n

Google Workspace Admin Help — Route outgoing SMTP relay messages through Google. Reviewed October 14, 2026.

", "content_text": "Scope senders, public egress addresses, and TLS requirements before routing device notifications through Google Workspace.\nSource facts\nGoogle’s SMTP relay documentation offers separate controls for allowed senders, authentication, and TLS. Administrators can restrict sending to specified public IP addresses and can require TLS, rejecting connections that do not use it. Sender choices include registered users or addresses in the organization’s domains; Google does not recommend allowing any address indiscriminately. The relevant IP range is the sending system’s public egress, not simply its private LAN address.\nSource: Google Workspace Admin Help — Route outgoing SMTP relay messages through Google.\nApplicability\nUse this for an approved Google Workspace relay design for on-premises devices or applications. Verify account eligibility, the selected authentication method, and each device’s supported TLS behavior.\nDSE recommendation\nDSE recommends listing the devices, approved sender addresses, public egress paths, relay owner, and alert recipients before configuration. Use the smallest justified source range and an allowed-sender policy that matches the actual workflow. Plan for an ISP or firewall change that alters egress addressing. Keep notification tests separate from production alarms so a troubleshooting exercise cannot be mistaken for a real incident. Record how delivery failures reach the administrator responsible for the device.\nVerification\nSend a labeled test notification and confirm receipt and relay logs. Under controlled conditions, verify rejection from an unauthorized source or sender and validate the required TLS behavior. Retain sanitized delivery evidence; a successful test does not guarantee future delivery of every alert.\nOfficial reference\nGoogle Workspace Admin Help — Route outgoing SMTP relay messages through Google. Reviewed October 14, 2026.", "content_markdown": "Scope senders, public egress addresses, and TLS requirements before routing device notifications through Google Workspace.\n\n## Source facts\n\nGoogle’s SMTP relay documentation offers separate controls for allowed senders, authentication, and TLS. Administrators can restrict sending to specified public IP addresses and can require TLS, rejecting connections that do not use it. Sender choices include registered users or addresses in the organization’s domains; Google does not recommend allowing any address indiscriminately. The relevant IP range is the sending system’s public egress, not simply its private LAN address.\n\nSource: [Google Workspace Admin Help — Route outgoing SMTP relay messages through Google](https://knowledge.workspace.google.com/admin/gmail/advanced/route-outgoing-smtp-relay-messages-through-google?hl=en).\n\n## Applicability\n\nUse this for an approved Google Workspace relay design for on-premises devices or applications. Verify account eligibility, the selected authentication method, and each device’s supported TLS behavior.\n\n## DSE recommendation\n\nDSE recommends listing the devices, approved sender addresses, public egress paths, relay owner, and alert recipients before configuration. Use the smallest justified source range and an allowed-sender policy that matches the actual workflow. Plan for an ISP or firewall change that alters egress addressing. Keep notification tests separate from production alarms so a troubleshooting exercise cannot be mistaken for a real incident. Record how delivery failures reach the administrator responsible for the device.\n\n## Verification\n\nSend a labeled test notification and confirm receipt and relay logs. Under controlled conditions, verify rejection from an unauthorized source or sender and validate the required TLS behavior. Retain sanitized delivery evidence; a successful test does not guarantee future delivery of every alert.\n\n## Official reference\n\n[Google Workspace Admin Help — Route outgoing SMTP relay messages through Google](https://knowledge.workspace.google.com/admin/gmail/advanced/route-outgoing-smtp-relay-messages-through-google?hl=en). Reviewed October 14, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/google-workspace-device-smtp-relay-boundaries/", "url": "https://update.dsesecurity.com/updates/google-workspace-device-smtp-relay-boundaries/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-14" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/google-workspace-device-smtp-relay-boundaries/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Constrain Google Workspace SMTP relay for device alerts", "item": "https://update.dsesecurity.com/updates/google-workspace-device-smtp-relay-boundaries/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/google-workspace-device-smtp-relay-boundaries/#article", "identifier": "https://update.dsesecurity.com/updates/google-workspace-device-smtp-relay-boundaries/", "url": "https://update.dsesecurity.com/updates/google-workspace-device-smtp-relay-boundaries/", "headline": "Constrain Google Workspace SMTP relay for device alerts", "description": "Scope senders, public egress addresses, and TLS requirements before routing device notifications through Google Workspace.", "abstract": "Scope senders, public egress addresses, and TLS requirements before routing device notifications through Google Workspace.", "articleBody": "Scope senders, public egress addresses, and TLS requirements before routing device notifications through Google Workspace.\nSource facts\nGoogle’s SMTP relay documentation offers separate controls for allowed senders, authentication, and TLS. Administrators can restrict sending to specified public IP addresses and can require TLS, rejecting connections that do not use it. Sender choices include registered users or addresses in the organization’s domains; Google does not recommend allowing any address indiscriminately. The relevant IP range is the sending system’s public egress, not simply its private LAN address.\nSource: Google Workspace Admin Help — Route outgoing SMTP relay messages through Google.\nApplicability\nUse this for an approved Google Workspace relay design for on-premises devices or applications. Verify account eligibility, the selected authentication method, and each device’s supported TLS behavior.\nDSE recommendation\nDSE recommends listing the devices, approved sender addresses, public egress paths, relay owner, and alert recipients before configuration. Use the smallest justified source range and an allowed-sender policy that matches the actual workflow. Plan for an ISP or firewall change that alters egress addressing. Keep notification tests separate from production alarms so a troubleshooting exercise cannot be mistaken for a real incident. Record how delivery failures reach the administrator responsible for the device.\nVerification\nSend a labeled test notification and confirm receipt and relay logs. Under controlled conditions, verify rejection from an unauthorized source or sender and validate the required TLS behavior. Retain sanitized delivery evidence; a successful test does not guarantee future delivery of every alert.\nOfficial reference\nGoogle Workspace Admin Help — Route outgoing SMTP relay messages through Google. Reviewed October 14, 2026.", "datePublished": "2026-10-15T00:43:30+00:00", "dateModified": "2026-10-15T00:44:33+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/google-workspace-device-smtp-relay-boundaries/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/google-workspace-device-smtp-relay-boundaries/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Constrain Google Workspace SMTP relay for device alerts" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 263, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Google Workspace Admin Help — Route outgoing SMTP relay messages through Google", "url": "https://knowledge.workspace.google.com/admin/gmail/advanced/route-outgoing-smtp-relay-messages-through-google?hl=en" } } ] } }