smtp relay for google compute engine

Question

I have two domains, a .com and a .net. The .com has a website hosted at google and uses gmail. The .net is a google compute engine with no associated mail accounts that runs its own webserver and uses postfix configured for outgoing mail only on port 587. I need an smtp relay for outgoing administrative email. I'm currently using another site I run as a stopgap measure, but I thought there ought to be a way to use one of google's smtp relays to do this. I've tried using aspmx2.googlemail.com but that doesn't seem to work (the relays that show up as MX records for the .com domain); but I get a network unreachable error:

postfix/smtp[2180]: ... relay=none, delay=30065, delays=30035/0.09/30/0, dsn=4.4.1, status=deferred (connect to aspmx2.googlemail.com[2607:f8b0:4001:c12::1a]:587: Network is unreachable)

I'm assuming the other relays in that group won't work either.

I've configured the smtp-relay service for the .com to allow relaying from the .net system.

Any help would be much appreciated.

update: removed relays which didn't work at all. Using smtp-relay.gmail.com does better, but still fails:

Aug  1 20:27:43 xblgx-ops postfix/master[30890]: daemon started -- version 3.1.0, configuration /etc/postfix
Aug  1 20:29:32 xblgx-ops postfix/pickup[30893]: BA3D73F79F: uid=1002 from=
Aug  1 20:29:32 xblgx-ops postfix/cleanup[30906]: BA3D73F79F: message-id=
Aug  1 20:29:32 xblgx-ops postfix/qmgr[30894]: BA3D73F79F: from=, size=418, nrcpt=1 (queue active)
Aug  1 20:29:32 xblgx-ops postfix/smtp[30910]: connect to smtp-relay.gmail.com[2607:f8b0:400e:c09::1c]:587: Network is unreachable
Aug  1 20:29:33 xblgx-ops postfix/smtp[30910]: Untrusted TLS connection established to smtp-relay.gmail.com[74.125.195.28]:587: TLSv1.2 with cipher ECDHE-ECDSA-AES128-GCM-SHA256 (128/128 bits)
Aug  1 20:29:33 xblgx-ops postfix/smtp[30910]: BA3D73F79F: to=, relay=smtp-relay.gmail.com[74.125.195.28]:587, delay=0.49, delays=0.03/0.02/0.39/0.05, dsn=5.7.0, status=bounced (host smtp-relay.gmail.com[74.125.195.28] said: 550-5.7.0 Mail relay denied [35.230.53.86]. Invalid credentials for relay for 550-5.7.0 one of the domains in: insidexblgx.internal, c.insidexblgx.internal, 550-5.7.0 xblgx-ops.c.insidexblgx.internal, xbiologix.net (as obtained from 550-5.7.0 HELO and MAIL FROM). 550-5.7.0 Email is being sent from a domain or IP address which isn't registered 550-5.7.0 in your G Suite account. Please login to your G Suite account and 550-5.7.0 verify that your sending device IP address has been registered within 550-5.7.0 the G Suite SMTP Relay Settings. For more information, please visit 550 5.7.0  https://support.google.com/a/answer/6140680#maildenied m11sm1647381ooe.3 - gsmtp (in reply to MAIL FROM command))
Aug  1 20:29:33 xblgx-ops postfix/cleanup[30906]: 3BBED3F7A0: message-id=
Aug  1 20:29:33 xblgx-ops postfix/qmgr[30894]: 3BBED3F7A0: from=, size=3849, nrcpt=1 (queue active)
Aug  1 20:29:33 xblgx-ops postfix/bounce[30913]: BA3D73F79F: sender non-delivery notification: 3BBED3F7A0
Aug  1 20:29:33 xblgx-ops postfix/qmgr[30894]: BA3D73F79F: removed
Aug  1 20:29:33 xblgx-ops postfix/smtp[30910]: Untrusted TLS connection established to smtp-relay.gmail.com[74.125.195.28]:587: TLSv1.2 with cipher ECDHE-ECDSA-AES128-GCM-SHA256 (128/128 bits)
Aug  1 20:29:33 xblgx-ops postfix/smtp[30910]: 3BBED3F7A0: to=, relay=smtp-relay.gmail.com[74.125.195.28]:587, delay=0.45, delays=0/0/0.39/0.05, dsn=5.1.1, status=bounced (host smtp-relay.gmail.com[74.125.195.28] said: 550-5.1.1 The email account that you tried to reach does not exist. Please try 550-5.1.1 double-checking the recipient's email address for typos or 550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1  https://support.google.com/mail/?p=NoSuchUser s2sm145038otd.5 - gsmtp (in reply to RCPT TO command))
Aug  1 20:29:33 xblgx-ops postfix/qmgr[30894]: 3BBED3F7A0: removed

The sending machine has IP 35.230.53.86 which shows on my google compute console VM as the proper IP, although a reverse dns shows it as 86.53.230.35.bc.googleusercontent.com. The IP has been explicitly allowed in the gsuite gmail settings for the .com domain:

Outbound from xbiologix.net
Allowed senders: Only addresses in my domains
Only accept mail from the specified IP addresses: Yes
Allowed IP addresses: xbiologix.net
Require SMTP Authentication: No
Require TLS encryption: No

Note that the domain xbiologix.net is the last domain in the log line complaining about invalid domains. But what does "my domains" mean? How does gsuite know what my domains are?

I modified the postfix main.cf to include:

smtp_helo_name = [35.230.54.86] xbiologix.net

But I now get:

Aug  1 21:17:51 xblgx-ops postfix/smtp[422]: connect to smtp-relay.gmail.com[2607:f8b0:400e:c09::1c]:587: Network is unreachable
Aug  1 21:17:51 xblgx-ops postfix/smtp[422]: 7B1383F79E: to=, relay=smtp-relay.gmail.com[74.125.195.28]:587, delay=0.32, delays=0.02/0.02/0.28/0, dsn=4.4.2, status=deferred (lost connection with smtp-relay.gmail.com[74.125.195.28] while performing the HELO handshake)

Answer 1

Have a look at the error message:

Aug 1 20:29:33 xblgx-ops postfix/smtp[30910]: BA3D73F79F: to=, relay=smtp-relay.gmail.com[74.125.195.28]:587, delay=0.49, delays=0.03/0.02/0.39/0.05, dsn=5.7.0, status=bounced (host smtp-relay.gmail.com[74.125.195.28] said: 550-5.7.0 Mail relay denied [35.230.53.86]. Invalid credentials for relay for 550-5.7.0 one of the domains in: insidexblgx.internal, c.insidexblgx.internal, 550-5.7.0 xblgx-ops.c.insidexblgx.internal, xbiologix.net (as obtained from 550-5.7.0 HELO and MAIL FROM). 550-5.7.0 Email is being sent from a domain or IP address which isn't registered 550-5.7.0 in your G Suite account. Please login to your G Suite account and 550-5.7.0 verify that your sending device IP address has been registered within 550-5.7.0 the G Suite SMTP Relay Settings. For more information, please visit 550 5.7.0 https://support.google.com/a/answer/6140680#maildenied m11sm1647381ooe.3 - gsmtp (in reply to MAIL FROM command))

This behavior explained at the documentation Sending email from an instance:

... if you are familiar with G Suite and are already paying for a G Suite account that supports email, you can set up a relay service to send email through G Suite. Note that Gmail and G Suite enforce limits for email activity.

If you don't have a G Suite account or don't want to use G Suite or a third-party mail provider, you can set up your own email server on an instance using a non-standard port. You can choose any ephemeral port that isn't blocked by Compute Engine.

• To use SendGrid, Mailgun, or Mailjet: Follow the instructions for Sending Email using SendGrid, Sending Email using Mailgun, or Sending Email using Mailjet.
• To use a G Suite domain: Follow the instructions for SMTP relay service settings in the G Suite documentation. SMTP relaying through G Suite is only allowed through ports 465 or 587. Port 25 is not supported through G Suite.

also, at the section Using standard email ports:

By default, Compute Engine allows outbound connections on all ports but port 25, which is blocked because of the risk of abuse. All other ports are open, including ports 587 and 465.

and at the RFC 5321:

4.5.4.2. Receiving Strategy

The SMTP server SHOULD attempt to keep a pending listen on the SMTP port (specified by IANA as port 25) at all times. This requires the support of multiple incoming TCP connections for SMTP.

As you can see, accordingly to the documentation and RFC you can reach your goal in the 2 ways: using your paid GSuite account or using paid 3rd party services.

In addition, you can try to configure relay via your existing smtp server based on Postfix that you mentioned above.