Set Up Scan‑to‑Email on MFPs with Microsoft 365 or Gmail in Australia

Scans stopped sending after a security update? This guide shows a safe, modern scan to email setup for Brisbane offices. It works with Microsoft 365 or Gmail, covers TLS ports, and fixes common Aussie ISP quirks.

Good for small teams, tradies, clinics, and anyone who needs fast, reliable document email from a multifunction printer.

Key takeaways

• Use a dedicated mailbox for each device, or an approved SMTP relay from a static public IP.
• Microsoft 365: smtp.office365.com, port 587, STARTTLS, SMTP AUTH enabled, or OAuth if your MFP supports it.
• Gmail: smtp.gmail.com with app passwords and 2‑Step Verification, or Workspace SMTP Relay by IP.
• Common errors: 535 auth failed, 5.7.57 relay denied, wrong SSL/TLS or blocked port 25 on some NBN plans.
• Set SPF/DMARC right to stop scans hitting spam and keep your domain reputation clean.

Scan to email setup: what you need before you start

• Accounts: a mailbox like scan@yourdomain.com.au in Microsoft 365 or Google Workspace.
• Security: MFA on the account and an app password if the MFP cannot do OAuth.
• DNS: SPF record includes your sending method (Microsoft 365, Google, or your static IP).
• Ports and TLS: Port 587 with STARTTLS or 465 with SSL/TLS. TLS 1.2 is required by most providers.
• Firmware: Update the MFP to the latest firmware so modern auth and ciphers work.
• Network: Static public IP if using SMTP relay by IP. Check if your ISP blocks port 25.

What it is and core concept

Definition

Scan‑to‑email is when your multifunction printer scans a document and sends it as an email using SMTP. The device signs in to a mail server, talks over TLS, and delivers the file to one or more addresses. A proper scan to email setup avoids spam flags and keeps sending stable.

Why it matters

Brisbane SMEs use scans for invoices, job cards, HR, tenders, and patient files. After Microsoft and Google tightened auth, older settings broke. The right method keeps scans flowing, meets security rules, and reduces time wasted at the printer on a busy workday.

How it works and step-by-step

Process

Use this simple flow:

• Pick a method: Microsoft 365 SMTP AUTH, Exchange Online SMTP relay, or Gmail SMTP/app password.
• Create a dedicated mailbox (or approve your static IP for relay).
• Update MFP firmware and set correct date/time and DNS.
• Enter SMTP host, port, TLS, username, and password/app password, or OAuth if supported.
• Set From address to the mailbox. Add allowed recipient domains if your model needs it.
• Send a test to an internal and an external address. Check spam and headers.
• Lock it down: least‑privilege, audit, and SPF/DMARC alignment.

Featured answer

For Microsoft 365, use smtp.office365.com on port 587 with STARTTLS, a dedicated mailbox, and SMTP AUTH enabled for that user. For Gmail, use smtp.gmail.com with an app password and 2‑Step Verification. If you have a static public IP, set an Exchange Online or Google Workspace SMTP relay and send without per‑device credentials.

Option A: Microsoft 365 SMTP AUTH (per‑device mailbox) with OAuth where supported

• Create a user mailbox like scan@yourdomain.com.au (licence required for a mailbox).
• In Exchange Online, allow SMTP AUTH for that mailbox only.
• Settings on the MFP: Host smtp.office365.com, Port 587, STARTTLS/TLS, Username full mailbox address, Password the user password or an app password if MFA is on.
• If your MFP supports OAuth 2.0 for SMTP or Microsoft 365, register the device/app in Azure AD and complete the device‑side OAuth setup. This removes stored passwords.
• From address must match the mailbox. Use authentication, not anonymous send.

Option B: Exchange Online SMTP relay via your public IP

• Needs a static public IP in Brisbane. Add that IP to an Exchange Online connector that accepts from your organisation’s IPs.
• MFP settings: Host your MX record (e.g., yourdomain-com-au.mail.protection.outlook.com), Port 25 with TLS if supported. No username or password.
• From address must be your verified Microsoft 365 domain. Random external From domains will be blocked with 5.7.57 relay denied.
• Some Aussie ISPs block port 25 on NBN. Ask for unblocking on business plans, or use Option A instead.

Option C: Gmail SMTP using app passwords and secure settings

• For Google Workspace or Gmail, turn on 2‑Step Verification for the scan mailbox, then create an app password.
• MFP settings: Host smtp.gmail.com, Port 465 with SSL or 587 with STARTTLS, Username full mailbox address, Password the app password (not your normal sign‑in password).
• Set From address to the mailbox. Less secure app access is retired, so app passwords or OAuth are required.
• For Workspace SMTP Relay by IP, allow your static IP in Admin Console and use Port 587 with TLS, no login.

Configure popular models: Brother, HP, Canon, Epson, FujiFilm (Apeos)

• Brother: Web panel > Network > Mail Server. Use STARTTLS on 587. Enter mailbox creds. Set From to the mailbox. Update firmware for TLS 1.2.
• HP LaserJet/Flow: EWS > Scan > Email Setup. Choose SMTP with authentication. Newer models can use Modern Authentication/OAuth for Microsoft 365.
• Canon imageRUNNER ADV: Remote UI > Settings/Registration > Function Settings > Send. Use SMTP AUTH and TLS. For OAuth‑capable units, follow Canon’s Microsoft 365 OAuth guide.
• Epson Workforce: Web Config > Email Server. 587 STARTTLS is most stable. Confirm DNS and time sync to stop cert errors.
• FujiFilm (Apeos): Admin > Email Settings. Set SMTP AUTH and TLS. Some models support device certificates; load the latest CA bundle to avoid TLS errors.

Tip: If the panel shows “server certificate not trusted”, the device clock or CA store is out of date. Fix those before testing again.

Common problems in Brisbane

Weather and infrastructure

• Summer storms and heat cause brief dropouts. Scans queue, then fail with timeouts. A small UPS on the MFP and router helps during flickers.
• Humidity in coastal suburbs can warp paper and trigger jams. Keep paper sealed and the MFP away from windows.
• Older buildings in Woolloongabba, East Brisbane, and Fortitude Valley may have messy cabling. DNS fails cause auth errors.
• NBN port 25 blocks on consumer plans (Telstra, TPG, iiNet, Aussie Broadband). For SMTP relay, ask for a business service or use port 587 with auth.

Troubleshooting and quick checks

Short answer

If you see 535 or 5.7.57 errors, check the From address, username, and TLS port. Use port 587 with STARTTLS for Microsoft 365 and Gmail. Confirm SMTP AUTH is allowed on the mailbox, or switch to an approved IP‑based relay. Update firmware and re‑enter the app password.

Quick checks

• Confirm date/time and DNS on the printer. Wrong time breaks TLS.
• Use the exact mailbox as the From address.
• Microsoft 365: smtp.office365.com, port 587, STARTTLS, SMTP AUTH on for that user.
• Gmail: smtp.gmail.com with app password. Try port 465 SSL if 587 fails.
• Sending to external only? Try internal first. If internal works, fix SPF/DMARC for external.
• Getting 5.7.57 relay denied? You’re not authenticated or your IP isn’t on the relay allow list.
• Scan a tiny PDF to test. Big scans can hit size limits (common 20–35 MB).

Safety notes and when to call a pro

Security tips

• Create a least‑privilege mailbox per device. Do not reuse admin accounts.
• Turn on MFA and use an app password if the device cannot do OAuth.
• Set SPF to include Microsoft 365 or Google, or your static IP if relaying.
• Review DMARC at p=quarantine or p=reject once you confirm scans pass alignment.
• Limit who can send to external addresses on the MFP panel.
• Audit sent mail in the mailbox and keep alerts for unusual spikes.

Red flags

Stop and get help if the printer must use plain SMTP without TLS, staff ask for shared admin passwords, or emails go out from your domain that you did not send. If you see repeated 535 or 5.7.57 errors despite correct settings, your method may be blocked by policy.

When to book professional setup for Brisbane businesses

Call a pro if you need an Exchange Online connector with a static IP, OAuth setup on Canon or HP, or your ISP blocks port 25 and you can’t change plans. Sites with multiple MFPs, Scan to Shared Folder, or strict DMARC also benefit from a nurse‑clean configuration and documentation.

Local insights and examples

Brisbane/SEQ examples

In North Lakes and Chermside, we often set Microsoft 365 SMTP AUTH with dedicated mailboxes on Brother and Epson units. It’s quick and reliable on NBN 50/20.

Around Milton and West End, older Canon and FujiFilm devices that can’t do OAuth run well with Exchange Online SMTP relay over a business static IP. We add the IP to the connector and update SPF.

For clinics in Sunnybank and Eight Mile Plains using Google Workspace, app passwords on smtp.gmail.com with SSL 465 works best. We cap attachments at 15–20 MB and add a fallback share link.

FAQs

Q1: Which method should my small business pick?

Use Microsoft 365 SMTP AUTH with a dedicated mailbox if you don’t have a static IP. If your provider gives you a static IP, SMTP relay is simple and robust. For Google Workspace, use app passwords or Workspace SMTP Relay. Pick the one your MFP and network support best.

Q2: Do I need a static IP for scan‑to‑email?

No for authenticated SMTP on port 587 with Microsoft 365 or Gmail. Yes for IP‑based SMTP relay on port 25. If you lack a static IP or your ISP blocks port 25, go with the authenticated method instead.

Q3: Why do I get 535 or 5.7.57 errors?

535 means the username or password (or app password) failed, or SMTP AUTH is off. 5.7.57 means your device tried to relay without auth, or the IP isn’t allowed on a connector. Fix TLS, From address, and method to match your provider.

Sources and further reading

Key frameworks: Microsoft 365 SMTP AUTH and SMTP Relay, Azure AD Modern Authentication (OAuth 2.0), Google app passwords and Workspace SMTP Relay, TLS 1.2 for SMTP, and email authentication standards SPF, DKIM, and DMARC. Align your method with these to keep mail trusted and deliverable.

Wrap-up and next steps

Pick the path that fits your gear and internet: Microsoft 365 SMTP on 587, an Exchange Online relay with a static IP, or Gmail with app passwords. Keep security tight, test small, then roll out to staff. Need help on site in Brisbane? Service:
Printer Setup Services