A working scan to email setup for Gmail using an app password
The exact configuration to send scanned documents from an office MFP through Gmail or a Google Workspace account using SMTP and an app-specific password — no OAuth required.
Google deprecated basic SMTP authentication with regular passwords in 2022, breaking many older MFPs that could not implement OAuth. The replacement Google supports for legacy SMTP clients is the App Password — a 16-character generated password tied to a specific application that authenticates over SMTP without OAuth. For office MFPs that send scan-to-email through a Gmail or Workspace account, this is the practical setup path.
Account requirements
App passwords require 2-Step Verification enabled on the source Google account. The account must be a personal Gmail account or a Workspace account where the admin allows app passwords. Workspace admins may have disabled app passwords organisation-wide — verify with the admin before relying on this approach.
Step-by-step setup
Enable 2-Step Verification on the Google account
Sign in to the account at myaccount.google.com. Open Security → 2-Step Verification → Get Started. Complete the 2-Step setup using SMS or Authenticator. This is required before app passwords can be generated.
Generate an app password
Back in Security, find App Passwords (may need to scroll down or search). Click App Passwords. Sign in again. Enter "Office MFP" or similar name for the new app password. Click Create. A 16-character password displays — copy it now (it cannot be retrieved later).
Open the MFP's SMTP settings page
Browse to the device web admin interface, navigate to Network → SMTP or Scan to Email → SMTP Server. The exact path varies by vendor — see the network setup tutorial for common menu paths.
Enter Gmail SMTP server parameters
SMTP server: smtp.gmail.com. Port: 587 for STARTTLS or 465 for SSL/TLS. Authentication: enabled. Username: the full Gmail address (e.g., scans@empresa.com). Password: the 16-character app password generated in step 2.
Configure From address and Reply-to
From address must match the Gmail account exactly. Reply-to can be a different address if responses should go elsewhere — the office's shared inbox, the IT support address, or the originating user's address.
Set sender display name
Use something users will recognise as legitimate — "Office Scanner" or the company name plus location. Avoid generic names that recipients might mistake for spam.
Test by sending a scan to yourself
From the device touchscreen, scan a single page to your own email. Check that the email arrives within 30-60 seconds. Verify the From address, attachment quality, and any subject/body template defaults.
Gmail SMTP server reference
Configuration values
Attachment size considerations
Gmail enforces a 25 MB per-message attachment limit. Scan output can easily exceed this on multi-page color scans at high resolution. The mitigation is configuring the MFP's default scan settings to produce smaller files: 300 dpi greyscale instead of 600 dpi color, JPEG compression on the resulting PDF, and splitting large documents into multiple emails of 20-page batches each. The device's default scan profile should be tuned to stay comfortably under the limit for typical documents.
Daily send limits
Personal Gmail accounts cap at 500 outbound messages per 24 hours. Google Workspace business accounts cap at 2,000. For a single office MFP these limits are rarely tested — a busy office sends maybe 100 scan emails on a heavy day. For a fleet of MFPs sharing one Gmail account, monitor utilisation: if total daily scan emails approach the limit, distribute the load by giving each device its own Workspace account or sending through a different SMTP provider.
Common configuration issues
What can go wrong
- "Authentication failed" errorThe app password was copied incorrectly (extra spaces, character substitution) or 2-Step Verification is not enabled on the account. Generate a fresh app password and re-enter carefully.
- "Less secure app" error messageThe MFP is trying to authenticate with the account password instead of the app password. Confirm the app password is what is configured in the SMTP settings, not the user's login password.
- Workspace admin has disabled app passwordsThe admin can disable app passwords organisation-wide. Coordinate with the admin to enable them for the scan account, or use OAuth-based scan-to-email instead.
- Emails marked as spam by recipientsThe MFP's IP is not authorised to send for the From domain. Configure SPF, DKIM, and DMARC records appropriately, or send through an SMTP relay that handles these.
- Attachments larger than 25MB silently failThe MFP may not warn about size before sending. Configure the device's scan default to lower resolution or smaller file format to stay under the limit.
- Port 25 blockedSome Spanish ISPs block outbound port 25 to prevent spam. Use port 587 (STARTTLS) or 465 (SSL/TLS) — both are typically unblocked.
The OAuth alternative
Newer MFPs (2023+ firmware) often support OAuth 2.0 for Gmail authentication, avoiding app passwords entirely. The setup is more complex — registering an OAuth application in Google Cloud Console, granting it Gmail send scope, and configuring the MFP to use the OAuth credentials — but the result is more secure and the connection does not break when account passwords rotate. For new deployments where the MFP supports it, OAuth is the recommended path. For older MFPs where OAuth is not available, app password is the working alternative.
Workspace versus personal Gmail
For office use, a Google Workspace account is preferred over a personal Gmail account. Workspace allows custom domain From addresses (scans@empresa.com rather than empresa.scans@gmail.com), higher send limits, admin oversight of usage, and central account management when staff changes. Personal Gmail works for very small offices but introduces account ownership questions that Workspace avoids.