ScanTransit setup guide
Last updated: 6 July 2026
What you’ll need
- A Mac that stays on and connected to your local network, ideally with a fixed or reserved IP address (set a DHCP reservation on your router).
- Administrator access to that Mac for the one-time install.
- A Google Workspace or Microsoft 365 mailbox you’re happy to send all scans from.
- Your scanner, copier or multifunction device on the same network.
1. Install ScanTransit
Download the ScanTransit DMG, drag ScanTransit into Applications, then open it. Click Install. macOS will ask an administrator to approve the background service once. After that, ScanTransit works from a standard (non-admin) login too.
2. Sign in to your mailbox
Open Settings, then the Sending account tab. Choose Google Workspace or Microsoft 365, click Sign in, and complete the consent screen in your browser. ScanTransit stores the resulting credentials on your Mac and never asks for your mailbox password directly.
If your Microsoft 365 tenant was created after January 2020, ask your IT administrator to enable authenticated SMTP submission for the sending mailbox first. This is a one-line setting in the Microsoft 365 admin centre, and something we can help with if you’re an Automatica client.
3. Set up the device account
Open Settings, then the Device account tab. Set a username and password for your scanner to use when it connects. This is separate from your mailbox password, and it’s the only credential your device will ever see.
4. Choose a port and connect your device
Point your device’s SMTP (scan-to-email) settings at your Mac’s LAN address, using whichever port matches its capabilities:
| Port | Encryption | Use for |
|---|---|---|
| 25 | None | Older devices with no TLS support |
| 587 | STARTTLS | Most modern MFDs |
| 465 | Implicit TLS | Devices that expect TLS from the first byte |
Settings shows your Mac’s current LAN address alongside all three ports. If your device insists on validating the certificate, use the Get certificate action in Settings to view the fingerprint, or supply your own certificate if your organisation runs an internal certificate authority.
5. Test it
Use Send test email in the ScanTransit main window to confirm mail is delivering before you walk back to the device. Once that succeeds, run a real scan from the device itself.
Keeping it secure
- Bind ScanTransit to your LAN only, and don’t forward its ports through your firewall to the public internet. It’s a submission relay locked to one outbound mailbox, not an open relay, but it should never be internet-facing.
- Use the optional IP allowlist in Settings if you want to restrict submissions to specific device IP addresses.
- Treat the Mac running ScanTransit like any other piece of infrastructure: keep macOS up to date, and limit who has administrator access to it, since that access can reveal the device account password.
- If you ever need to see the device password again, for example to configure a second scanner, Settings will prompt for administrator credentials before revealing it.
Troubleshooting
- If a device gets a temporary delivery failure, check that you’re still signed in under Settings → Sending account. ScanTransit queues failed sends and retries automatically once you’re signed in again.
- The main window’s status card always shows the one thing to do next, whether that’s approving the background service, signing in, or checking a failed send.
Need a hand? Get in touch and we’ll help you get it connected.