Device setup

Pointing your equipment at send25.

Ten minutes if the device is co-operative. This page covers the other case too — the specific, well-known ways copier firmware gets this wrong, so you recognise them instead of losing an afternoon.

1 · Which port 2 · The settings 3 · Your brand 4 · Known traps 5 · Testing 6 · When it argues

1 · Which port can this device actually manage?

Answer this first. It decides everything else, and it is the question most setup guides skip — they assume a device that can do modern authentication, which is precisely the assumption that broke your scanner in the first place.

Can it do STARTTLS and a username and password?	Use port 587. Best option. The device works from any network, and if it is ever compromised we revoke that one credential without touching anything else.
Only TLS 1.0 or 1.1?	Use port 25. We refuse TLS 1.0 and 1.1 — they are deprecated and forbidden under PCI-DSS. A device offering only those will fail on 587 with a handshake error that usually appears as a bare "cannot connect". This is common on firmware older than about 2018 and is not fixable from our side.
No encryption at all?	Use port 25. We allow-list your office IP instead. This is the case this service exists for.
Encryption, but no authentication?	Use port 25. It will still negotiate STARTTLS opportunistically, so the traffic is encrypted — it is simply your IP address rather than a password that identifies you.

Not sure what the device supports? Choose port 25 and the IP allow-list. It works on everything, it is not less secure in transit, and you can move a device to 587 later without touching anything else. Nobody has ever regretted starting here.

2 · The settings

Port 587 — username and password

SMTP · authenticated

Server: mail.send25.net
Port: 587
Encryption: STARTTLS not SSL — see the traps below
Authentication: On — "Normal password" / "Basic" / "Login"
Username: the full string we issue, including @mail.send25.net
Password: from your console
From address: anything@your-verified-domain.com

Port 25 — no credentials

SMTP · IP allow-listed

Server: mail.send25.net
Port: 25
Encryption: Off, or STARTTLS if offered whichever the device supports
Authentication: Off
Username: — none —
Password: — none —
From address: anything@your-verified-domain.com

Tell us the public IP the device sends from — the office's internet address, not the printer's 192.168.x.x. If you don't know it, open any "what is my IP" site from a computer on the same network.

3 · What your brand calls these fields

Menus move between firmware versions, so we won't pretend to give you exact keystrokes — a wrong instruction wastes more of your time than none. What doesn't change is the vocabulary, and the quirk each manufacturer is known for.

Canon imageRUNNER · imageCLASS

Settings live in the Remote UI (browse to the printer's IP) under Settings/Registration → Network → TCP/IP → E-mail/I-Fax.

SMTP Server	mail.send25.net
SMTP AUTH	On for 587, off for 25
Allow SSL/TLS	On for 587 (this is STARTTLS despite the label)
E-Mail Address	Your From address — Canon uses this as the sender

Canon's known quirk: the port field is sometimes hidden until SMTP AUTH is enabled. If you cannot find where to type 587, turn authentication on first.

Ricoh Aficio · MP · IM series

Web Image Monitor → Device Management → Configuration → Email.

SMTP Server Name	mail.send25.net
Port No.	587 or 25
Use Secure Connection (SSL)	On for 587
SMTP Auth. Email Address	Your From address

Ricoh's known quirk: "Administrator's Email Address" and "SMTP Auth. Email Address" are different fields and both end up in message headers. Set both to an address on your verified domain, or the device will send as something we refuse.

Xerox WorkCentre · VersaLink · AltaLink

CentreWare / Embedded Web Server → Properties → Connectivity → Setup → SMTP.

SMTP Server	mail.send25.net
Device Email	Your From address
SMTP Authentication	On for 587
Connection Encryption	STARTTLS — Xerox lists it separately from SSL, choose STARTTLS

Xerox's known quirk: newer VersaLink firmware validates the certificate and will refuse if the device's clock is wrong. If it fails immediately with a certificate error, check the date and time first.

Konica Minolta bizhub

PageScope Web Connection → Network → E-mail Setting → E-mail TX (SMTP).

SMTP Server Address	mail.send25.net
Port No.	587 or 25
SSL/TLS	STARTTLS for 587
Device Mail Address	Your From address

bizhub's known quirk: there is a separate "Connection Timeout" that often defaults to 30 seconds. Large scans over a slow uplink can exceed it and appear as a random failure on big documents only.

Sharp MX series

Web page → System Settings → Network Settings → SMTP Setup.

Primary SMTP Server	mail.send25.net
Port Number	587 or 25
SMTP Authentication	On for 587
Sender Address	Your From address

Sharp's known quirk: the username field is often limited to 32 characters. If our credential is longer, it will be silently truncated — see the traps below.

HP LaserJet · OfficeJet · PageWide

Embedded Web Server → Scan/Digital Send → Email Setup. HP offers a wizard; choose the manual/custom path rather than letting it auto-detect.

SMTP Server	mail.send25.net
Port	587 or 25
Server requires authentication	Tick for 587
From address	Your From address

HP's known quirk: the auto-detect wizard probes port 465 first and reports failure before trying anything else. Skip it.

Brother MFC series

Web Based Management → Network → Protocol → SMTP → Advanced Settings.

SMTP Server Address	mail.send25.net
Port	587 or 25
SMTP AUTH Method	SMTP-AUTH for 587, None for 25
Device E-mail Address	Your From address

Brother's known quirk: older firmware exposes "SSL/TLS: SSL" and "SSL/TLS: TLS" where TLS means STARTTLS. Choose TLS, not SSL.

Anything else Toshiba, Kyocera, Lexmark, Epson, older kit

Every device asks the same five things under different names:

SMTP Server / Mail Server / Host	mail.send25.net
Port / Port No.	587 or 25
SSL / TLS / Secure Connection	STARTTLS on 587; off or STARTTLS on 25
SMTP AUTH / Server requires authentication	On for 587, off for 25
From / Sender / Device Email	An address on your verified domain

If a field exists that isn't listed here, leave it at the default. And if you're stuck, send us the make and model — support@send25.net. We would rather spend ten minutes on it than have you give up.

4 · The traps that actually cost people an afternoon

These are not theoretical. In rough order of how often they bite.

TRAP 1
"SSL" on port 587 makes it hang rather than fail

There are two different things called encryption. Implicit SSL starts encrypted immediately and lives on port 465. STARTTLS connects in the clear and then upgrades — that is what 587 uses.

Tick "SSL" with port 587 and the device sits waiting for a TLS handshake that never comes, while we wait for a plain-text greeting. Neither side errors; it just hangs until the timeout. A hang rather than a clean failure is why this one eats so much time.

The same confusion appears in software as secure: false, Enable SSL: OFF and -UseSsl — all of which mean STARTTLS on 587.

TRAP 2
The device truncates the username at the @

Our credential looks like yourname@mail.send25.net. Some firmware treats the field as a mailbox name and silently keeps only the part before the @ — or has a 32-character limit and cuts the end off.

The device then reports 535 authentication failed, which sends you chasing the password. Re-open the field and look at what it actually kept. If it has been shortened, that is your answer.

TRAP 3
The From address isn't on a domain you've verified

Devices ship with defaults like scanner@localhost, noreply@printer, or the serial number. We will refuse those with 553 5.7.1 You are not authorised to send as this domain — the same message an impostor would get, because it is the control that stops one customer sending as another.

Set the sender to a real address on your own verified domain. On Ricoh and some Xerox models there are two such fields and both matter.

TRAP 4
The scan is bigger than it looks

Our limit is 25 MB, but email encoding inflates attachments by roughly a third. A 20 MB PDF arrives as about 27 MB and is refused with 552.

Colour at 600 dpi produces enormous files. Dropping to 300 dpi, or greyscale, typically cuts it by three-quarters with no practical loss on a document scan.

TRAP 5
Firmware too old for modern TLS

We refuse TLS 1.0 and 1.1 — deprecated, and forbidden under PCI-DSS. A device that only speaks those cannot use port 587 at all, and the symptom is usually a bare "cannot connect to server" with no detail.

This is not fixable from our side and often not from yours. Use port 25 with an IP allow-list instead — which is exactly the situation this service was built for.

TRAP 6
The office IP changed and nobody noticed

If you are on port 25 with an allow-listed address and your ISP rotates it, everything stops at once with 554 5.7.1 Client host rejected. It typically happens after a router reboot or a line fault, so it looks like the device broke.

A static IP avoids it. If you can't have one, move the devices to port 587 with credentials — then the address stops mattering entirely.

5 · Testing it worked

Three tests, each proving something different. Do them in order.

The device's own test button. Proves the device can reach us and, on 587, that the credential is accepted. It does not prove the mail is deliverable — many devices report success as soon as we say 250 OK.
Scan something to your own address. Proves the whole path, including size limits and the From address. Use a real multi-page document, not a single blank sheet — that is how you find the size trap before a customer does.
Open the message and read the headers. The real test. In Gmail use Show original; in Outlook, Properties → Internet headers. You want SPF: PASS, DKIM: PASS and DMARC: PASS. That is the recipient's own verdict, not ours.

Then check your send25 console — the message appears in your log with the receiving server's exact response, which is what tells you why if something fails later.

6 · When it argues

Symptom first, because that is what you actually have. Every code below is explained in full in the reference.

It just sits there, then times out

Almost always TRAP 1 — "SSL" ticked on port 587. Switch it to STARTTLS, or to whatever the device calls TLS as distinct from SSL.

If that isn't it: something between the device and us is blocking outbound 25 or 587. Many business routers and some ISPs block outbound 25 by default. Test from a computer on the same network — if that also fails, it is the network, not the device.

"Authentication failed" or 535

In order of likelihood: the username was truncated at the @ (TRAP 2); the password has a character the device mangles; or the device is sending credentials on port 25, where we don't accept them.

Re-open the username field and read what it kept. If in doubt, we will reissue the credential — it takes seconds and costs nothing.

"Access denied" or 554 5.7.1

We don't recognise where you're connecting from. On port 25 that means the source address isn't allow-listed — usually because it changed (TRAP 6). Check your current public IP and send it to us.

On 587 it means no valid credential was presented at all.

"Not authorised to send as this domain" or 553 5.7.1

The connection is yours; the From address is not (TRAP 3). Either the device is sending as a default like scanner@localhost, or the domain hasn't finished verifying in your console.

Check the domain shows green under DNS setup, and check every sender field on the device — some brands have two.

Big scans fail, small ones work

TRAP 4 — the 25 MB limit, reached sooner than you'd expect because encoding adds about a third. Reduce resolution to 300 dpi or scan in greyscale.

On Konica Minolta, also check the connection timeout — a large file over a slow uplink can exceed a 30-second default and fail for a reason that has nothing to do with size limits.

It sends, but the mail lands in junk

Nearly always DNS. Open your console and confirm all three records show green — an unsigned or unauthenticated message is the single biggest reason for junk placement, and it is the one thing we cannot fix from our side.

If DNS is green and it still happens, send us one of the messages with full headers and we will read the receiving server's verdict with you.

It worked for weeks, then stopped

Three usual causes, in order: the office IP changed (TRAP 6); a firmware update reset the SMTP settings — more common than it should be, and worth checking the fields rather than assuming; or a DNS record was edited during other work.

Your console shows the last message we saw from you and the exact rejection, which normally identifies which of the three it is in seconds.

Nothing above matches

Email us at support@send25.net with the make and model, which port you tried, and the exact error text the device shows. The exact wording matters — it usually identifies the cause immediately.

You are not the first person whose copier has argued with a mail server, and we would rather look at it than have you guess.

Request access Publish your DNS Full reference