Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →To send Ubuntu mail through a Gmail or Google Workspace mailbox, configure Postfix as a local SMTP client, point relayhost at [smtp.gmail.com]:587, authenticate with a Google app password, and require STARTTLS. The bracketed host-and-port must match in both Postfix and the password map. This setup sends outbound mail through Google; it does not turn your Ubuntu machine into a public, inbound mail server.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What this setup does
Postfix is Ubuntu’s mail transfer agent. In a relay configuration it accepts mail from local programs, queues it, and hands each outbound message to Google instead of attempting direct delivery to the recipient’s mail server. Applications can continue to submit mail through the local sendmail interface while Postfix handles the remote SMTP connection.
As an Amazon Associate I earn from qualifying purchases.
The instructions below target a Gmail or Google Workspace mailbox that can authenticate as an SMTP client. Google Workspace organizations that need centralized, IP-based or policy-based sending should use the separate Workspace SMTP relay service described later; its hostname and administration model are different.
How mail moves through this configuration
A local application submits a message to Postfix, usually through the sendmail-compatible command or a local SMTP connection. Postfix places that message in its queue, reads relayhost, and opens an outbound connection to the Google submission service. With the configuration in this guide, the connection is made to smtp.gmail.com on TCP port 587. Postfix negotiates STARTTLS, authenticates with the account credentials from its SASL map, and then transfers the message.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Google performs the normal account, sender, spam, and quota checks before accepting the message. Acceptance by Google is not the same as guaranteed inbox placement; the recipient’s provider and Google’s filtering systems can still defer, quarantine, or reject mail. The Ubuntu host is acting as a submission client, not as an independent Internet mail domain, so it does not need to receive SMTP connections from the public Internet for this design.
Choose the Google service before editing Postfix
| Use case | SMTP hostname | Authentication model | Encryption options | Administrative controls and published limits |
|---|---|---|---|---|
| One Gmail or Workspace mailbox | smtp.gmail.com |
Mailbox authentication with an app password when the client cannot perform interactive OAuth | Port 587 with STARTTLS; port 465 with implicit SSL | Account and organization policy apply. Google’s current administrator guidance lists 2,000 messages per day for the Gmail SMTP option. |
| Organization-managed application relay | smtp-relay.gmail.com |
Workspace administrator policy, commonly based on authorized IP addresses and permitted senders | Ports 25, 465, and 587, with the TLS or SSL mode selected in the relay configuration | Administrator controls the relay. Google’s current guidance lists 10,000 recipients per user per day. |
Do not replace smtp.gmail.com with smtp-relay.gmail.com merely because both names contain “gmail.” The relay service requires Workspace administrator configuration and can apply different sender, IP, and policy checks. Google recommends the SMTP relay service for mail sent by devices or applications when an organization can administer that policy.
Requirements and preparation
- An Ubuntu host with root or
sudoaccess and a working DNS resolver. - Outbound network access to the Google submission port you select. This guide uses TCP 587 and STARTTLS.
- A complete Gmail or Workspace address, such as
[email protected]or your full organization address. - Google 2-Step Verification enabled on that account if you will use an app password.
- Permission from the Workspace administrator if the account is organization-managed. App passwords can be disabled by policy or made unavailable by Advanced Protection.
- A local way to submit a test message. Ubuntu’s Postfix package provides the local sendmail-compatible interface; a mail utility can make testing more convenient.
Record the Ubuntu and Postfix versions while diagnosing problems. Package names, defaults, and available SASL modules differ between Ubuntu releases.
1. Install Postfix and the SASL client support
Update the package index and install Postfix together with the SASL client modules required by your Ubuntu release. A typical Debian/Ubuntu installation is:
sudo apt update
sudo apt install postfix libsasl2-modules ca-certificatesIf your release presents a different SASL package name, install the package identified by that release’s Postfix documentation. During the package dialog, select the Internet-site or satellite/system-relay style that best describes the host. The dialog creates an initial /etc/postfix/main.cf; inspect that file rather than assuming the installer’s defaults are suitable.
Postfix normally starts as a system service after installation. You can check its state with:
Recommended Free Tools
sudo systemctl status postfix2. Configure the Gmail submission endpoint
Open the main configuration:
sudoedit /etc/postfix/main.cfSet the relay and client-security parameters. Remove or replace duplicate definitions so that the active value is unambiguous:
relayhost = [smtp.gmail.com]:587
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_sasl_tls_security_options = noanonymous
smtp_tls_security_level = encryptWhy each setting matters
relayhosttells Postfix to submit mail to Google. The brackets make the destination literal instead of asking Postfix to look up the destination domain’s MX records. The:587suffix selects the submission port.smtp_sasl_auth_enable = yesenables SMTP client authentication.smtp_sasl_password_mapspoints Postfix to an indexed credentials database generated from/etc/postfix/sasl_passwd.smtp_sasl_security_options = noanonymousprevents anonymous SASL mechanisms.smtp_sasl_tls_security_options = noanonymousapplies the same anonymous-mechanism restriction when TLS is active.smtp_tls_security_level = encryptrequires encryption for the outbound SMTP session, preventing a plaintext fallback before credentials or message data are sent.
Port 587 is Google’s STARTTLS submission path. Port 465 is the implicit-SSL alternative, but it requires the corresponding Postfix wrapper-mode settings; do not simply change 587 to 465 while leaving a STARTTLS configuration unchanged.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Port 587 versus port 465
These ports are not interchangeable transport labels. On port 587, Postfix connects to the SMTP service in its plain protocol state, issues or receives the STARTTLS transition, validates the TLS session, and only then authenticates. That is why smtp_tls_security_level = encrypt is important: it makes an unencrypted fallback unacceptable.
Port 465 uses implicit SSL, meaning TLS is established as soon as the TCP connection is opened. Google documents both ports, but Postfix must be configured for wrapper mode when using 465. If a firewall permits only one of the ports, choose the matching TLS mode rather than changing the number in one setting. A “Must issue STARTTLS first” response usually indicates that the client and server disagree about this sequence.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute3. Create and protect the SASL password map
Create the source map with the exact bracketed destination used in relayhost:
sudoedit /etc/postfix/sasl_passwdEnter one line, replacing the address and token:
[smtp.gmail.com]:587 [email protected]:APP_PASSWORDUse the complete account address, not only the part before the @. The destination key is exact: [smtp.gmail.com]:587 must match character-for-character. A key such as smtp.gmail.com, [smtp.gmail.com], or port 465 will not satisfy a lookup for the configured relay.
Restrict the source file to root and build Postfix’s indexed database:
sudo chown root:root /etc/postfix/sasl_passwd
sudo chmod 600 /etc/postfix/sasl_passwd
sudo postmap /etc/postfix/sasl_passwd
sudo chmod 600 /etc/postfix/sasl_passwd.dbPostfix reads the credentials from its configuration area before dropping privileges. Keeping both files readable only by root limits exposure of the app password. Run postmap again after every edit; changing the text file without rebuilding the database leaves Postfix using the old value.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems4. Create a Google app password
The value after the colon in sasl_passwd should normally be a Google app password, not the account’s ordinary password. App passwords are separate credentials for an application or device. Google states that they can be used only on accounts with 2-Step Verification enabled.
- Sign in to the Google account that will submit the mail.
- Enable 2-Step Verification if it is not already enabled.
- Open the account’s App passwords page and create a credential for this Postfix host or application.
- Copy the generated value into
/etc/postfix/sasl_passwdwithout adding spaces. If Google displays grouped characters, enter the actual password value as Google specifies. - Regenerate the map with
sudo postmap /etc/postfix/sasl_passwd.
Google recommends OAuth where a client supports it, but a traditional Postfix SMTP client cannot complete an interactive browser sign-in in this configuration. Workspace administrators can restrict app-password use, and Advanced Protection can make it unavailable. An account-password change revokes its app passwords, so a previously working relay can begin returning authentication errors after that event.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
5. Restart Postfix and send a controlled test
Restart the service so it reloads main.cf and the password map:
sudo systemctl restart postfixSubmit a plain-text message to an address you control:
printf 'Subject: Postfix testnnThis is a test.n' | sendmail -v [email protected]The -v option prints the SMTP conversation summary while Postfix queues the message. In a second terminal, follow the service log:
sudo journalctl -u postfix -fA successful transaction should show connection to Google, STARTTLS negotiation, SASL authentication, acceptance of the message, and a final delivery status. Do not paste the password-map contents or an authentication token into a ticket or shared log.
6. Verify the effective configuration
When the service behaves differently from the file you edited, ask Postfix what value it is actually using:
postconf relayhost smtp_sasl_auth_enable smtp_sasl_password_maps smtp_tls_security_levelCheck for duplicate lines, misspelled parameter names, an unexpected chroot path, or a password-map path that differs from the file you created. The map must be readable by the Postfix process at the path shown by smtp_sasl_password_maps, while the source credentials remain restricted to root.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Reading the result and isolating failures
Test one variable at a time. First verify that Postfix is running and can resolve the Google hostname. Next confirm that the log shows a TCP connection and TLS negotiation. Only after those stages succeed should you troubleshoot the account token or sender policy. This order distinguishes a blocked network path from a bad credential and prevents repeatedly changing several settings at once.
A queued message is not automatically a failed message. Postfix can queue mail while it waits for a temporary network, TLS, authentication, or policy condition, then retry it. Follow the service journal until the attempt ends with either a successful acceptance or a specific SMTP response. Repeated test submissions can consume the account’s sending allowance and make troubleshooting harder.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Using Google Workspace’s SMTP relay service instead
Organizations that send from servers, scanners, games, monitoring systems, or other applications may prefer the administrator-controlled service at smtp-relay.gmail.com. A Workspace administrator must configure allowed IP addresses or other relay policy, permitted sender domains, and the required TLS or SSL behavior in the Admin console. The service accepts ports 25, 465, and 587.
This is not a drop-in hostname substitution. With smtp.gmail.com, Postfix authenticates as a mailbox, typically with an app password in this setup. With smtp-relay.gmail.com, Google evaluates the organization’s relay policy and may authorize the originating IP or sender without a mailbox password. Sender-domain restrictions and administrator settings therefore determine whether a message is accepted.
Google’s current administrator guidance lists a limit of 10,000 recipients per user per day for the Workspace SMTP relay option. The same guidance lists 2,000 messages per day for the Gmail SMTP option. These are service limits, not a guarantee that every message will be delivered: Google can also defer or filter suspicious traffic.
The relay service is often easier to govern when many machines need to send mail. The administrator can document approved source IP addresses and sender domains instead of distributing one mailbox credential to every host. Conversely, a single small server may be simpler to operate with smtp.gmail.com and one dedicated app password. Make that choice before deploying configuration, because changing endpoints also changes the authentication and policy checks.
Common failures and precise fixes
535 authentication failure
- Confirm that the username is the full Gmail or Workspace address.
- Generate a new app password rather than retrying the normal account password.
- Verify that 2-Step Verification is enabled and that Workspace policy permits app passwords.
- Check that
/etc/postfix/sasl_passwdcontains exactly[smtp.gmail.com]:587and that you reranpostmapafter editing. - Check whether a recent account-password change revoked the app password.
530 5.7.0 Must issue STARTTLS first
The client attempted authentication or delivery before negotiating TLS. Confirm that smtp_tls_security_level = encrypt is active and that the relay is using port 587 for STARTTLS. A configuration intended for port 465 cannot be made correct by changing only the port number.
550 relay or sender-policy error
Google may reject the envelope sender or relay attempt when the sender domain is not permitted, the Workspace relay IP is not registered, or the mailbox authentication does not authorize the sender. Determine whether you are using the mailbox endpoint or the Workspace relay endpoint, then check the corresponding account or administrator policy.
No worthy mechs found
Postfix cannot find a SASL mechanism that satisfies the active security policy. Inspect the installed SASL client modules and the values of smtp_sasl_security_options and smtp_sasl_tls_security_options. This error can occur when mechanisms are missing or when plaintext mechanisms are disallowed before TLS.
No connection to Google
- Resolve
smtp.gmail.comthrough the host’s DNS configuration. - Check outbound firewall and cloud-network rules for TCP 587.
- Verify that the selected port is permitted by the local network or hosting provider.
- Review the Postfix and Ubuntu versions because package defaults and available modules vary.
Mail is queued but not delivered
Follow journalctl -u postfix -f until the queue attempt completes. Separate temporary deferrals from permanent SMTP responses, correct the underlying authentication, TLS, policy, or network issue, and then allow Postfix to retry. Repeated test messages can consume the provider’s sending allowance.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Operational and security checklist
- Use port 587 with STARTTLS and require encryption before authentication.
- Keep
/etc/postfix/sasl_passwdand its database owned by root and mode 600. - Rebuild the map after every credential change.
- Use a distinct app password for this host or application so it can be revoked independently.
- Rotate or revoke the app password when the server is decommissioned or the account’s role changes.
- Confirm that the envelope sender and visible From address comply with the Gmail or Workspace policy.
- Monitor Postfix logs for authentication failures, repeated deferrals, unexpected senders, and queue growth.
- Stay within Google’s published service limits and expect additional filtering for suspicious volume or content.
- For organization-wide application sending, document the Workspace relay IP and sender policy instead of distributing a mailbox password to every server.
What a correct result looks like
The Ubuntu application submits locally, Postfix selects [smtp.gmail.com]:587, negotiates STARTTLS, authenticates with the configured app password, and receives an acceptance response from Google. The message then appears in the recipient mailbox or in Google’s normal delivery and filtering pipeline. If you instead configured smtp-relay.gmail.com, acceptance depends on the Workspace administrator’s relay policy rather than the mailbox app-password exchange.
Frequently Asked Questions
Can I use my normal Gmail password in sasl_passwd?
Normally no. Use a Google app password for this non-interactive SMTP client. App passwords require 2-Step Verification, and a Workspace administrator or Advanced Protection policy can disable them.
Free tools Windows power users keep installed
One-click scans. No signup required.
Why must the relayhost contain brackets?
The brackets make smtp.gmail.com a literal relay destination instead of causing Postfix to perform recipient-domain MX delivery. The same bracketed host and port must be used as the key in sasl_passwd.
Is port 465 a replacement for port 587?
It is an alternative encryption mode, not a number to swap into the existing configuration. Port 587 uses STARTTLS; port 465 uses implicit SSL and requires matching Postfix wrapper-mode settings.
When should I use smtp-relay.gmail.com?
Use it when a Google Workspace administrator can configure an application relay policy, such as authorized source IP addresses and permitted sender domains. It is intended for organization-managed devices and applications and does not use the same mailbox app-password exchange.
What does a 535 response usually mean?
Check the complete account address, generate a fresh app password, verify 2-Step Verification and Workspace policy, confirm the exact [smtp.gmail.com]:587 map key, and rerun postmap. An account-password change also revokes existing app passwords.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Why do I get “Must issue STARTTLS first”?
Authentication or delivery was attempted before TLS. Confirm that port 587 is selected and that the effective configuration contains smtp_tls_security_level = encrypt. Do not use a port-465 configuration with STARTTLS settings.
What are the sending limits?
Google’s current administrator guidance lists 2,000 messages per day for the Gmail SMTP option and 10,000 recipients per user per day for the Workspace SMTP relay option. Filtering and policy checks can still defer or reject mail below those limits.
How do I protect the app password on Ubuntu?
Keep both /etc/postfix/sasl_passwd and its generated database owned by root with mode 600, rebuild the database after edits, avoid putting credentials in tickets or shared logs, and revoke the app password when the host is retired.
The Bottom Line
For a mailbox-based relay, use [smtp.gmail.com]:587, an app password, an exact bracketed SASL map key, and mandatory STARTTLS. Use smtp-relay.gmail.com only when Workspace administration and policy-based relay are deliberately configured.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
