Enter your idea

As an MSP that uses Xero one of my customers employees received several Online Crypto Purchase Invoices coming from Xero email accounts. He does not do Crypto for 1. Secondly these are phishing emails using messaging.service@post.xero.com.

This is why we need our own ability to use our own domain to send out these messages.

If Xero is going to take any responsibility and Liability for someone clicking on a bad link or paying for an unknown invoice, then keeps the domain as Xero. I will be happy to have the attorneys that received this fight this battle. It was a law firm that received several of these messages I attached so other users can see what they received.

I appear "Bad Actors" are now trying to use Xero to fool people into paying for Crypto using Xero. Invoices. Xero either knows about this and is investigating the issue or no one has mentioned it to them and are unaware about this issue. I am assuming nothing is being said from Xero about this yet as they are investigating.

Xero you can reach out to me directly if you need to. But if I start losing customers because of this I will take legal means to hold you accountable for all money's lost and future estimated costs.

We have started seeing that emails are getting blocked as the "Display Name" doesn't match the email address of "message-service@post.xero.com".

To stop this we created a custom address in Xero and set the "Display Name" to "message-service" and then the users real email as the Reply-To address.

It's not ideal, but it seems to be helping for now.

This volume of rejected emails has risen to astronomical records recently. No matter what Xero can do, if it is incapable of sending invoices to our clients then it is no good for our business and will need to be changed irrespective of the problems that creates.

This is important and needs to be added.

I am currently unable to use Xero to send invoices to clients - because they think it is junk mail and refuse to open it.

We need the ability to send email from our own domain to prevent spam. It is ridiculous that Xero cannot accept that companies want their invoices sent out from their own company domain.

Furthermore, it is one thing for Xero to suggest asking a company IT dept to ensure that emails from post.xero.com are whitelisted, and quite another trying to talk private individuals, with limited computer knowledge, using dozens of different email clients, through doing the same thing.

Closing the last thread where this was being requested was a cynical ploy from Xero to prevent discussion about an essential feature. This requirement, and discussion about it, is not going away.

Hi Adam,

My review wasn't flagged flagged by them and is still displayed online. They shouldn't be able to block your review if you followed TrustPilot guidelines.

Xero then marks the review "flagged your review for containing harmful or illegal content."

Hi everyone,

Try leaving your Xero feedback on TrustPilot and ProductReviews:
https://au.trustpilot.com/review/www.xero.com
https://www.productreview.com.au/listings/xero

Xero wants to look good for their new customers, and with an influx of reviews, we have a chance to make our voices heard!

Surprised since the Google and Yahoo updates this hasn't become a top priority. Being able to utilize a branded sending domain or custom domain so it appears from your business is critical these days. I think the biggest thing holding this back is both platform limitations/resources required, and the fact that Xero would have to partner with a larger company already doing this right like Mailgun or Sendgrid. Consider this my vote for a more compliant email delivery option for invoices.

So just an update here: I just received 4 emails that came from post.xero.com that look like phishing attempts. One invoice, one statement, two thank yous for paying the invoice. None of these are invoices for a vendor we work with or have heard of, and we never paid anything.

This is why it's important - for customer trust - to have the emails coming from the company that's billing the client, NOT from Xero. These looked reasonably legit and the first thing I look at when I get an email that doesn't smell right is the return address. Now you have phishing emails using the server that Xero uses for legit emails. That's just great.

I've used Zoho products before and my experience was great at first then customer service became a nightmare, and prices increased a lot, and development stopped listening and negotiations of pricing became difficult. Unfortunately, this is not on a Zoho or any other application. Which is why I go with Customer Service as a high number is calculating what products I refer and use. I was more upset than people on any of the Xero boards. Also, Xero is just getting started in the US compared to Europe. It is much bigger platform there vs here and so much better than QuickBooks even with the things it needs to develop.

I do agree we should have the option to use our own domains as a way to send out invoices, quotes, etc..

It should be able to be implemented from knowing software dev. Just have us user set Cname and txt to verify the domain so that liability is off Xero's hands.

> As using SMTP should not be enabled or any other method as it is not secure and the liability of everyone increases.

As an additional note that might help other companies, we have done a workaround as follows:

> When the invoice is being sent, we make sure is "Send me a copy" option is enabled. Since our organization uses Microsoft 365 for business as an email service, we have created an automation using "power automate" to set up automated resend from shared "Sales@" email every time "@post.xero.com" with another filtered email is received.
> if you have your IT service provider, you can ask them to help you. If not, request to the post, and I might post detail ways on how to if Xero allows.

>Has anyone got feedback / recommendations they'd like to share?

We're moving to Zoho as soon as the tax season in the US is over.

Funny, I was on vacation in the UK recently and saw a ton of ads on TV for Xero. I can confirm that this appears to be where they're putting their money - into roping in new suckers, not into improving the software. Between this issue, the way they handle ACH payments through Stripe, and the inability to have multiple contacts within a single client, we're done.

Zoho appears to do everything we want, I've been testing it and will get it set up and fully running in parallel with Xero over the next couple weeks, then as soon as our accountant is done with our taxes, we're done with Xero. It's slightly cheaper, gives us a feature that allows us to cancel another subscription (time tracking, which we do through e-hour now), and it looks to be under active development with a responsive support team.

Has anything changed on Xero side (I suspect not, but checking)?

On our side, the costs to invoices being blocked / flagged as spam, etc. is high enough that it'll pay for another solution so we''re now looking into alternatives. Has anyone got feedback / recommendations they'd like to share?
- 3rd party tool that manages invoicing (takes payment / reconciliation uploads results to Xero)
- custom built solution
- Webhook from Xero to download / email from elsewhere (if we do that, likely 1 will be better)
- other?

Thanks

I think this should be really high on the todo list for Xero. It would be great to be able to send email correctly authenticated from our own domain. Most other major companies do this now (look at Shopify etc...).

@hannah G

This capability is NOT complex to implement, pretty much everybody is doing it now - it is VERY VERY easy to setup. Please stop gaslighting us

FEBRUARY 2024 IS COMING

As previously mentioned, Google and Yahoo are intensifying security efforts, requiring all email senders to comply with domain authentication by February 2024. I have just received confirmation that other service providers have begun taking action on the upcoming changes.

We have a MailerLite account that we no longer use, but, importantly, we received an email regarding this matter, which I have attached below. Essentially, they state that we need to configure domain authentication; otherwise, our emails will not be delivered.

Xero, do you still believe it's a good idea to ignore this problem?

This is such a simple thing to do, that I am ASTOUNDED that Xero is taking this approach. The problem is, that IF Google WorkSpace, MS Outlook, Yahoo and OTHERS all start rejecting Xero's emails, then we will have no choice but to move accounting platforms. Moving Mail platforms will not work, as EVERYONE will follow Google and Microsoft's lead, as everyone wants more secure and scam-proof email.

Changing our Accounts System is not something that any of us necessarily WANT to do, but we will have no choice. We have to be CERTAIN that our invoice emails etc can actually be received by our clients. Like it or not, DKIM and DMARC are coming, and if Xero WILL NOT bend, and comply, then maybe it will FOLD.

It now seems clear that Xero either can't or won't do this. Suggest people make other plans. This is the same attitude which lead Blackberry to annihilate themselves, having once been the market leader, in fact, had created the whole product-category of 'smartphone'. Where are Blackberry now? or Kodak?

Hello XERO Community,
It appears XERO has decided not to be compliant with modern email messaging standards when sending emails on behalf of its customers; a customer with clients using Google systems (such as Google Workspace or Google Enterprise) it appears will be unable to receive emails from XERO commencing February 2024.

Another discussion thread with XERO shows the community is not satisfied with XERO's lack of development to support DKIM and DMARC authentication for all domains, noting the ability to "Vote" interest and "How important is this to you?" are now enabled, we encourage all to vote and speak up.
* https://productideas.xero.com/forums/939198-for-small-businesses/suggestions/46571656-enable-dkim-to-reduce-sent-emails-from-being-flagg

Here is a good write-up on the evolving email-sending requirement that we found concerning Google's & Yarhoo's shift towards DKIM and DMARC authentication for all domains:
* https://www.valimail.com/blog/the-new-requirements-for-email-delivery-at-gmail/

And here are both Google's & Yahoo's pages on the announcements.
* https://blog.google/products/gmail/gmail-security-authentication-spam-protection/
* https://blog.postmaster.yahooinc.com/post/730172167494483968/more-secure-less-spam

Microsoft announced similar measures in July 2023 that have already taken effect, so clients with Office 365 will already be having issues receiving invoices from Xero.
* https://techcommunity.microsoft.com/t5/exchange-team-blog/announcing-new-dmarc-policy-handling-defaults-for-enhanced-email/ba-p/3878883

We hope the XERO team will reconsider; we want to keep our services with XERO. If we can not safely send Purchase Orders, Quotes, Invoices and other accounting-related services through XERO using our company email, we must consider alternative platforms to do our accounting.

In good faith :-)