“Recipient address rejected” (SMTP Relay)

The 550 Recipient address rejected error occurs when an application, server, or multi-function printer attempts to send an outbound message through the Google Workspace SMTP relay service (smtp-relay.gmail.com) but fails security validation. Google throws this bounce-back to prevent unauthenticated devices from using its network infrastructure as an open relay to blast spam. When this error trips, it indicates that either the sending device’s public IP address is missing from your configuration whitelist, or the relay settings are actively restricting traffic to internal domains only.

Fast-Fix: The 45-Second Solution

To fix the “Recipient address rejected” error, log into the Google Admin Console, navigate to Apps > Google Workspace > Gmail > Routing, and open your SMTP relay service settings. Ensure that the public outbound IP address of your sending server or application is explicitly added to the allowed IP list, or verify that the Allowed senders field is set to “Any addresses” if your application uses full SMTP authentication to send to external recipients. Risk: High (Systemic Outbound Automated Email Failure).

Quick Risk Snapshot

• Severity: High
• Safe to Send?: No (Automated systems, web applications, and local devices routing through this relay will fail to send)
• Primary Cause: Sending device IP address missing from the Workspace SMTP Relay whitelist
• Rare Cause: Misconfiguring an outbound relay as an inbound gateway, causing all external domains to be blocked

Low Risk vs. High Risk Paths

To properly isolate the issue, check who the email is addressed to:

• If the error only occurs when sending to external domains (e.g., @gmail.com or @yahoo.com) but internal mail works: Your SMTP relay is configured correctly for internal routing but is rejecting outbound relaying because the device hasn’t proven its authorization to send externally. This is a low-risk configuration gap. If your application is dropping connections entirely before receiving this response, see “Message not received” (Email Log Search).
• If the error occurs for all recipients, including internal users within your own domain: The relay configuration or IP address matching is completely broken, or the recipient mailbox does not exist. If the recipient address is internal and you suspect the account is missing or misspelled, see “5.1.1” Account does not exist.

How SMTP Relay Authentication Works

Think of Google’s SMTP relay service like a high-security automated shipping dock. When an application on your network wants to send an email to the outside world, it connects to smtp-relay.gmail.com and presents the package. Before Google agrees to route that package to an external destination, it demands identification.

It checks the delivery truck’s license plate (the sending server’s public IP address) against a registered list in your Admin Console, or it checks for a username and password match via SMTP authentication. If the application tries to ship a package to an external address without matching the security profile, Google’s gateway refuses to accept the recipient address, dropping the package right at the gate to prevent unauthorized use of its network.

Probability Breakdown

When troubleshooting this specific SMTP relay bounce, the underlying root causes fall into these probability ranges:

• Missing or Mismatched Public IP Address (60%): The application or local server is routing traffic through a dynamic IP or a secondary internet service provider (ISP) line that is not whitelisted in the Google Admin Console.
• Incorrect Allowed Senders Setting (25%): The relay is set to “Only addresses in my domains,” but the application is attempting to send mail using an envelope-from address that doesn’t match your exact verified Workspace domains.
• SMTP Authentication Omitted or Disabled (10%): The application is configured to use port 587 or 465 but does not pass valid Workspace credentials, forcing Google to rely strictly on IP authentication which then fails. If your application credentials are correct but failing to authenticate over secure ports, see Troubleshooting SMTP Relay: “550 5.7.1 Relaying Denied”.
• Inbound Gateway Rule Conflict (5%): The external recipient’s domain is being evaluated against local inbound gateway IP filters instead of outbound relay rules. If you suspect an IP routing overlap with your inbound defenses, see How to Resolve “Inbound Gateway” IP Mismatches.

What Increases the Risk

The likelihood of encountering this relay breakdown increases under these operational environment changes:

• Switching Office Internet Service Providers: Getting a new internet line changes your public-facing IP address, instantly invalidating your existing Workspace SMTP relay whitelists.
• Cloud Hosting Migrations: Moving a web application or ERP system from an on-premise server to AWS, Azure, or Google Cloud changes the outbound server IP address.
• Multi-Function Printer Replacements: Installing new office scanners or copiers without configuring their internal SMTP authentication settings or using the incorrect port layout.

Consequence Timeline

Allowing an SMTP relay error to persist creates immediate backlogs in automated workflows:

• 24 Hours: Immediate disruption to transactions. E-commerce sites fail to send order confirmations, office scanners fail to deliver documents, and password reset forms break.
• 72 Hours: Local application queue saturation. Sending servers will continually attempt to retry the failed connections, filling up local disk storage with deferred logs.
• 1 Week: Data loss. Local mail queues hit their expiration limits and discard the unsent transactional records, causing permanent loss of customer communications and system alerts.

What This Is Confused With

It is critical to separate this relay rejection from other delivery errors:

• Differentiate from standard user mailbox rejections: If a regular Gmail user gets a bounce-back while typing a message manually in their browser, it’s rarely a relay issue. “Recipient address rejected” via SMTP Relay specifically impacts machines and software applications connecting directly via SMTP code.
• Differentiate from mail loops: If an email bounces back and forth between two active mail servers without ever finalizing the delivery path, it will generate a loop warning rather than a direct relay rejection. For fixing cyclical routing loops, review How to Fix “Email Loop Detected” in Routing.

What To Do Right Now

• Identify your true public IP: Open a browser on the server running the application or run a curl ifconfig.me command in the terminal to find the exact public IP address leaving your building.
• Verify the relay configuration: Go to the Google Admin Console, look under the advanced Gmail routing rules, and compare your current public IP with the IP addresses listed in the SMTP relay service panel.
• Trace the specific message footprint: Use the unique tracking codes in your local server logs to match them against Google’s indexing records. For an in-depth look at tracing obscure deliveries, see How to Trace Missing Email via Admin Message ID.

Hard-Stop Triggers

Stop normal troubleshooting and immediately audit your network core if you notice these red flags:

• The SMTP relay begins rejecting internal domain addresses, indicating a complete de-authorization of your primary Workspace domain.
• Your sending server logs display an automated lockout due to a suspected brute-force credential attack on your SMTP ports.
• The Google Admin Console displays an account-wide alert stating that your outbound relay capacity has been suspended due to an internal spam breach.

What an Admin Will Check

A Workspace administrator resolving this relay failure will execute three verification checks:

• IP Range Scope: They will check if the corporate firewall is routing mail traffic across a cluster of dynamic IPs instead of a single static IP, necessitating the use of a CIDR notation range (e.g., /24) in the Google allowed list.
• Allowed Senders Alignment: They will ensure that the dropdown menu for allowed senders matches the application’s actual configuration. If the app sends notifications from noreply@system-alert.com, that domain must be verified inside the tenant or the setting must be toggled to “Any addresses.”
• Authentication Toggles: They will audit whether the “Require SMTP authentication” checkbox is enabled. If checked, the application must provide a valid Google Workspace mailbox username and password (or an App Password if 2FA is active) to send to external recipients.

Typical Effort Range

• Effort: Minor
• Resolution Time: 10 to 30 minutes. Updating the whitelisted public IP or adjusting the allowed sender dropdown menu in the Google Admin Console applies globally across Google’s network almost immediately, resolving the issue on the next application retry loop.

Related System Escalators

If your SMTP relay rejections happen alongside systemic routing issues where your organization uses hybrid servers to pass mail back and forth, ensure that your split delivery architecture isn’t dropping the message before it ever hits the outbound relay path. If you are balancing mailboxes between Google and an external platform, check the configuration rules outlined in Resolving Split Delivery Failures (M365 & Google).

Workspace Assessment

Fixing the “Recipient address rejected” error requires aligning your application’s connection footprint with Google’s security gate. Because Google tightly guards its SMTP relay service against open-relay exploitation, any unauthenticated or unlisted IP address trying to send mail externally will be shut down instantly. By locking down a static public IP address, entering it accurately into your Workspace routing settings, or enforcing strong SMTP authentication, you can safely restore your automated email flow within minutes.