Scan to Email:How to Set It Up and How to Fix It When It Breaks

Scan to email is five settings. Get them right and a fifteen-year-old copier will send PDFs reliably for another fifteen years. Get one wrong, or let your email provider change the rules underneath you, and you get a two-line error on a touchscreen and a line of people holding paper.

This guide does both jobs. If you’re setting up a printer or scanner from scratch, start right here. If yours was working and stopped, or errors out mid-setup, jump to the troubleshooting section and match the exact message on the screen to its fix.

The five settings every device needs

Every scan-to-email setup, on every brand, comes down to the same five values. Your printer builds the email; an SMTP server delivers it. The settings just tell the printer which server, how to connect, and who it’s allowed to send as.

1. SMTP server (host): the mail server’s address, like mail.smtp2go.com.
2. Port: the door the printer knocks on. 587 is the modern default.
3. Encryption: STARTTLS (usually shown as “TLS”) on 587, or SSL on 465. This must match the port.
4. Authentication: a username and password the server accepts. This is where most setups fail, and where most working setups later break.
5. From address: who the scans appear to come from. Increasingly, this address’s domain needs SPF and DKIM records or the scans land in junk.

Everything else on the settings screen is cosmetic.

A complete worked setup, filled in

Here’s a full configuration using SMTP2GO as the sending service, because it works identically across brands and doesn’t depend on which email provider your office uses. The same five fields apply if you point the device elsewhere; only the values change.

Step 1: Create credentials for the device. In your SMTP2GO dashboard, go to Sending > SMTP Users and add a user just for this device, something like office-copier-01. Two deliberate choices here: it’s not a person’s email account, so nobody’s password change can break it, and it contains no “@” symbol, because some printer panels mishandle usernames that look like email addresses, a quirk our support team has run into more times than anyone would like.

Step 2: Verify your sending domain. Under Sending > Verified Senders, add the domain the scans will send from and publish the SPF and DKIM records it gives you. Skip this and your scans may still send, straight into junk folders. The verified senders guide walks through the DNS records.

Step 3: Open the printer’s admin interface (see the per-brand table below) and enter:

Field	Value
SMTP server	mail.smtp2go.com
Port	587
Encryption	STARTTLS (shown as “TLS” on many panels)
Authentication	On (SMTP AUTH / Login)
Username	office-copier-01
Password	the password you set in Step 1
From address	scanner@yourdomain.com (a domain you verified in Step 2)

If 587 won’t connect on your network, don’t fight the firewall. SMTP2GO also accepts TLS or unencrypted connections on 25, 2525, 8025, and 80, and SSL on 465, 8465, and 443. Port 2525 gets copiers out from behind stubborn firewalls more often than any firmware update, and 443 looks like ordinary web traffic to almost every network. Details in the ports and secure connections guide. It’s the reason device manufacturers like it here: OPW Electronic Systems, which sends alerts from proprietary fuel-monitoring equipment on customer networks it doesn’t control, put it plainly: “The flexible number of available communication ports allows our equipment to work on almost all network configurations.”

Step 4: Send a test scan to an external address, not just a colleague on your own domain, for reasons covered in the FAQ.

Step 5: Confirm delivery on the SMTP2GO Activity page, which shows the scan as delivered, bounced, or deferred with the receiving server’s exact response. “Did it actually send?” stops being a mystery.

The settings take about two minutes to enter. Finding the settings screen is the slow part, which is what the next section is for. And when a first test scan fails, it’s nearly always one of the same three things: a panel that silently truncated a long password, port 587 filtered on the office network (switching to 2525 fixes that in seconds), or an unverified From domain sending the test straight to junk. Check those three before assuming anything is broken.

Where the settings live, brand by brand

Menu names drift a little between models and firmware versions, but every brand puts SMTP settings in its web-based admin interface, reached by typing the printer’s IP address into a browser.

Brand	Admin interface	Where to look	Step-by-step guide
HP	Embedded Web Server (EWS)	Scan/Digital Send > Email Setup or Outgoing Email Profiles	Use above
Canon	Remote UI	Settings/Registration > Send > Email Settings	Use above
Brother	Web Based Management	Network > Email > SMTP	Use above
Epson	Web Config	Network > Email Server > Basic	Use above
Sharp	Device web page	System Settings > Network Settings > SMTP	Use above
Kyocera	Command Center RX	Function Settings > Email	Kyocera setup guide
Xerox	Embedded Web Server	Connectivity > SMTP	Xerox WorkCentre guide
Ricoh	Web Image Monitor	Configuration > Email	Ricoh setup guide
Lexmark	Embedded Web Server	Settings > Email > Email Setup	Lexmark setup guide

More device and software walkthroughs live in the setup guides library.

Choosing what the printer sends through

You have three realistic options for the server in that table, and the right one depends on how much fragility you can live with.

Your Microsoft 365 tenant (smtp.office365.com). Works, for now, with a licensed mailbox and its password. But this is exactly the configuration Microsoft is retiring, covered in the next section, and it means a machine’s ability to send email depends on a human account’s password never changing.

Gmail or Google Workspace (smtp.gmail.com). A lot of small offices go this route because the account already exists. Know the constraints going in. Plain password sign-in from apps is gone, so the printer needs an app password, which requires 2-step verification on the account and gets revoked whenever the account password changes. Every password rotation becomes a printer outage. And Google caps sending at 500 messages a day on a free Gmail account and 2,000 a day on Google Workspace, which sounds like plenty until a document-heavy office or a fleet of devices shares one account and hits the wall mid-afternoon. Fine for one home-office device. Fragile for anything more.

A dedicated SMTP relay (SMTP2GO). The device gets its own credentials that no human password rotation can touch, one set of settings works across every brand and every site, eight ports mean firewalls stop being an argument, and provider deprecation timelines become someone else’s problem. This is the durable option, and it’s the one thing in this list actually designed for machines that send email.

Honest caveat: if your fleet is new, OAuth-capable, and scans mostly stay inside your own organization, Microsoft’s native methods are supported and free, and you should use them. The relay earns its keep with mixed-age hardware, multiple sites, no static IP, or a preference for configuring this once and never thinking about it again.

The Microsoft 365 deadline, and why it’s coming for your copier specifically

If your devices send through smtp.office365.com with a username and password, put this on the calendar.

Microsoft is retiring basic authentication (password sign-in) for SMTP. Personal outlook.com accounts already lost it in September 2024. For business tenants, Microsoft’s current timeline, revised in January 2026, runs: no change through December 2026, then disabled by default for existing tenants at the end of December 2026 (admins can re-enable it, for now), unavailable entirely on tenants created after that, and a final removal date to be announced in the second half of 2027. When it bites, the device shows some variant of authentication failure and the server logs 550 5.7.30 Basic authentication is not supported for Client Submission.

Multifunction printers are the most exposed devices in the building, for a boring reason: an installer configured them once, years ago, with a mailbox password nobody has touched since. They’ll keep working until the exact moment a tenant setting flips. And “disabled by default” means the flip can come early, from a security cleanup, Security Defaults being enabled, or a Conditional Access change, not just from Microsoft’s deadline.

How to tell if you’re affected: sign in to the Exchange admin center and open Reports > Mail flow > SMTP AUTH Clients Submission Report. Any device or app showing “Basic” is on borrowed time.

Whether your hardware can move to OAuth: support is genuinely uneven. HP offers OAuth scan to email on FutureSmart 5.7 or newer, but only on its Enterprise and Managed lines; consumer and Pro models like the OfficeJet Pro don’t get it. Lexmark added it in FW24, Canon on its unified Firmware Platform 3.18 or newer, and newer Sharp models include it. Xerox doesn’t support OAuth for scan to email at all, and Ricoh and Konica Minolta support is limited and model-dependent. Even inside a “supported” brand it varies by model, so validate on one device before planning a rollout.

Why re-enabling basic auth per mailbox is not the fix: it’s a snooze button. Admins can re-enable it today, but new tenants already can’t, the final removal date is coming, and every re-enable is a security exception someone has to remember, document, and defend at the next audit. You’d be spending effort to stay on a sinking configuration.

The durable fix for devices that can’t do OAuth (and for fleets where per-device OAuth setup is its own project) is an authenticated relay: point every device at mail.smtp2go.com on 587 with its own credentials, and Microsoft’s timeline stops applying to your copiers at all. Full background in our guide to the end of Microsoft’s basic authentication.

This is exactly why managed service providers standardized on relays years before any deadline forced the issue. Mark Shaw of Stored Technology Solutions, an MSP, has run client devices through SMTP2GO for well over a decade: “Since 2011, StoredTech has used SMTP2GO to help phone systems, copiers and printers, and other devices send emails with no headaches and no downtime.” One relay across every client site beats maintaining per-tenant Microsoft configurations that shift underneath you, and there’s a dedicated MSP program if that’s your world.

Troubleshooting: match the error on the screen to the fix

The error message tells you which stage failed. Find yours:

What the device says	Most likely cause	Fix
“Cannot resolve SMTP server” / “Server not found”	DNS is missing or wrong	Fix 1
“Connection refused” / “Cannot connect” / “SMTP gateway not responding” / timeout	Blocked port, firewall, or encryption mismatched to the port	Fix 2
“Authentication failed” / “535 5.7.3” / “Login incorrect”	Bad credentials, or a sign-in method your provider retired	Fix 3
“550 Relay access denied” / “550 5.7.1 Unable to relay”	Sending without authentication, or a From address the server won’t accept	Fix 4
“550 5.7.30 Basic authentication is not supported”	Microsoft switched off password sign-in for your setup	See the Microsoft deadline
Panel says “Complete” but nothing arrives	Spam filtering, file size, or a From address failing authentication	Fix 5
Works for some recipients, not others	Recipient-side filtering or address book errors	Fix 6

Before touching anything: get the device’s admin password and find out which account or service it’s configured to send through. Without those, troubleshooting stops in about ninety seconds.

Fix 1: “Cannot resolve SMTP server”

The printer can’t turn a hostname into an IP address. Nine times out of ten, someone assigned the printer a static IP and left the DNS fields blank. It prints fine (printing is local) and can’t email at all (email needs the internet, which needs DNS).

In the admin interface, check four values together: IP address, default gateway, preferred DNS, alternate DNS. On a business network, use the DNS servers the network already uses; on a simple one, 8.8.8.8 and 8.8.4.4 will do. Fix DNS and the error will often change to an authentication error. That’s progress, not a new problem: the printer found the server, and now the server is rejecting the login, so move to Fix 3.

Some older devices have DNS handling that’s simply broken. For those, skip the hostname and point the device at an IP address directly using SMTP2GO’s static IP options, which most mail providers don’t offer.

Fix 2: “Connection refused,” gateway not responding, or timeouts

DNS resolved, but the connection never completes. Almost always a port problem. ISPs routinely block port 25 outbound, plenty of networks block 587, and an encryption setting mismatched to the port (SSL selected on 587, or STARTTLS on 465) fails in ways the error won’t explain.

Test the path from any computer on the same network before blaming the printer:

telnet mail.smtp2go.com 2525

A 220 greeting means the door is open. Silence means the network is blocking it, and no printer setting will change that; switch ports instead (2525 and 443 are the great escape artists here). If connections open but die partway through, that’s a different animal, covered in our guide to SMTP timeouts.

While you’re in the admin interface, check the device’s date and time. Sounds unrelated. It isn’t. TLS certificates have validity windows, and a printer whose clock reset to 2019 after a power cut will fail every secure connection with maddeningly vague errors.

Fix 3: “Authentication failed” (535 errors)

The printer reached the server and the server said no. In order of likelihood:

The password changed. If the device authenticates with a person’s account and that person changed their password or left the company, scan to email died at that moment. Update the stored credentials, then read the worked setup above for why a machine shouldn’t borrow a human’s account in the first place.

The username has special characters. Some panels mishandle usernames containing “@” or store invisible trailing spaces. If you’re certain the credentials are right and it still fails, this is worth suspecting. SMTP2GO usernames don’t need to be email addresses (yours are under Sending > SMTP Users), which sidesteps the whole bug class.

The account requires an authentication method the printer doesn’t speak. The 2026 problem. See the Microsoft deadline section, and if the device can’t do standard SMTP authentication at all, there are alternatives, including authenticating by IP address.

One warning: don’t keep retrying guessed passwords against a Microsoft 365 or Google account. Repeated failures can lock it, and now you have two outages.

Fix 4: “550 Relay access denied” or “Unable to relay”

The server accepted the connection but refuses to carry your message. Two usual causes. Either authentication is switched off on the device (some setups “work” unauthenticated for internal mail only, then throw this the first time someone scans to an outside address), or the From address isn’t one the server permits. Turn SMTP authentication on with valid credentials, and make sure the From address belongs to a domain the service allows you to send as. On SMTP2GO that means a verified sender. More on the whole 550 family in our 550 error guide.

Fix 5: The panel says “Complete” but nothing arrives

The printer did its job; the message got filtered, bounced, or quarantined downstream. Three suspects:

File size. Scanner PDFs balloon fast. A 20-page color scan at 600 dpi can blow past the 25 MB cap common at major mailbox providers, and many devices report success anyway. Test with a one-page black-and-white scan. If the small one arrives and the big one doesn’t, drop resolution to 200 or 300 dpi and scan documents in black and white. More in the Goldilocks theory of email file sizes.

The From address is failing authentication. If the domain’s SPF and DKIM records don’t authorize the sending server, receiving servers treat every scan as a possible forgery. Some junk it, some silently drop it. Verify the sending domain (Step 2 of the worked setup) even if scans are currently arriving; it’s the difference between arriving and arriving in the inbox.

Recipient-side filtering. Check spam and quarantine. Scans are attachment-heavy messages from an unfamiliar sender, which also describes a lot of malware, so filters distrust them by design.

With a relay in the middle there’s no guessing at this stage: the Activity page shows delivered, bounced, or deferred with the receiving server’s exact words.

Fix 6: Works for some recipients, not others

The printer, network, and configuration are fine. Check the failing addresses for typos and stale address book entries first; a surprising number of “broken” copiers are faithfully emailing someone who left in 2022. If the addresses are right, the receiving domain is filtering you, and the verified sender fix is your strongest lever. Test one known-good external address, then add failures back one at a time until the pattern shows itself.

It worked yesterday. What changed?

When something that ran for years stops overnight, resist the factory reset. It erases the address book, network config, and SMTP settings, and fixes nothing if the change happened outside the printer. Run this list instead: Did anyone’s password change? Did IT enable Security Defaults or tighten Conditional Access? New firewall, new ISP, new VLAN? Firmware update? Power cut (clock drift, Fix 2)? Provider requirement change (the Microsoft section)? The date scan to email died is your best clue. Something changed that day, and finding it beats rebuilding everything and rediscovering it later.

Keep it from breaking again

Five minutes of discipline prevents most future 7 a.m. “copier’s down” calls. Give each device (or each site, if you’re an MSP) its own SMTP user, so one revoked credential never takes down the fleet. Verify the sending domain so scans go out SPF-aligned and DKIM-signed. Write the working configuration down somewhere that isn’t the printer. And update firmware on a schedule rather than in a panic, because updates occasionally reset SMTP settings, and you want to notice on your own terms.

Frequently asked questions

Does my printer need its own email address?

Only if you send through Microsoft 365 or Gmail, where the device borrows a real mailbox and its password. With a relay like SMTP2GO, no: the device gets an SMTP username that isn’t an email address, and the From address just needs to be on a domain you’ve verified. No license, no mailbox, nothing for a password rotation to break.

Why does scan to email work internally but not to outside addresses?

Your device is almost certainly sending unauthenticated to your own mail server, which will deliver to its own mailboxes but refuses to relay to the rest of the internet (that’s the “550 relay access denied” error). Turn on SMTP authentication with valid credentials, or send through a relay that authenticates every message.

What port should I use for scan to email?

587 with STARTTLS is the modern default. If your network blocks it, SMTP2GO also listens on 25, 2525, 8025, and 80 for TLS or unencrypted connections, and 465, 8465, and 443 for SSL. Try 2525 first behind strict firewalls, then 443.

Do I need SSL or TLS?

Yes, one of them; unencrypted SMTP sends credentials in the clear. The rule is matching, not choosing: STARTTLS (“TLS”) pairs with 587, SSL pairs with 465. Very old devices that only speak outdated TLS versions may fail against modern servers entirely, which is a firmware update or a replacement conversation.

Is scan to email going away because of Microsoft's changes?

No, but password sign-in to Microsoft 365 is. Under Microsoft’s current timeline, basic authentication for SMTP gets disabled by default for existing tenants at the end of December 2026, with final removal to be announced for the second half of 2027. Devices will need OAuth support, a Microsoft connector setup, or an SMTP relay to keep scanning.

What's a quick workaround while it's broken?

Most devices can scan to USB or a network folder (SMB), or scan to your own address so you can forward the attachment. Ugly, but it gets the closing packet out the door while you fix the real thing.

Still stuck?

Some of these failures are genuinely miserable to diagnose from a two-line touchscreen. If you’ve worked through the fixes and the device still won’t send, contact our support team. They’re humans, they’re around 24/7, and printer tickets are something they untangle every day. And if you’d rather take the email provider variable out of the equation for good, SMTP2GO is free to try for up to 1,000 emails a month, which covers a lot of scanning.