Email Settings - Custom sending domain security SPF;Dkim;Dmarc
With the implementation of Google and Yahoo email security please enable the ability to send out invoice, quotes and statements using our own domain.
We are seeing more emails that are sent from within Xero being flagged as Spam or put in Quarantine, especially if the recipient is using Outlook 365.
Xero needs to implement the ability to send from Xero from our own domain.
Please furnish us with SPF sending ip/include host name and DKIM certificate. This will reduce the number of email blocked/junkmail, and increase the security of mail sending.

-
Perry Paolantonio commented
I've been commenting on this post (and others like it) since we switched to Xero about 3 years ago. This is our #1 priority. We recently had another issue, and I want to make a suggestion to all the people who are affected by this:
Xero does not care what's written on the Xero Ideas posts. When you contact their support people they will say "Great Idea, you should post that as a Xero Idea" -- which is where ideas go to die.
I recently had a problem with bank feeds, and found an effective way to get the problem resolved to my satisfaction: I opened a support thread and every single time I had the problem I was trying to get fixed, I sent them a message on that thread letting them know it was still broken. They kept coming back with boilerplate responses (AI?). They called me on the phone and gave me the same excuses. But I persisted and eventually it got fixed.
The support folks need to close out support tickets, and they are (it seems) mandated to respond. So post your SPF/DKIM request to support. Then keep doing it. Ask them to escalate it after a few days (escalate seems to be a magic word).
Squeaky wheel gets the grease. But if there's a concerted effort it may get greased faster.
FWIW, one of our clients has outright bounced all email coming from post.xero.com - which means the invoice we sent them last night was returned. I got a message from Xero that the invoice couldn't be delivered. I talked to the client's IT people and they will not lift the block on post.xero.com because they get a ton of phishing emails now, using that as the return address.
The current situation is unworkable and Xero needs to provide this simple, industry standard fix.
-
James McConnell commented
Really surprised, and concerned, that this hasn't been implemented yet
-
Dennis Luckett commented
Just migrating from Kashflow at the moment - Xero better in some ways but this is one of those glaring obvious missing features.
-
Jonathan Fortin commented
This feature should have been implemented years ago. What is the point of having a quote or invoice system if we can't be 100% sure emails will be delivered?
The current recommendation from support—to ask clients to safelist Xero or allow specific IPs—is not scalable or practical. For larger corporations (e.g., 1,000+ employees), working through their IT departments is often slow or unfeasible. For small businesses, the technical know-how is often lacking.
A more practical solution would be to allow us to use our own sending domain for invoices. This would let us configure DKIM and SPF authentication ourselves, eliminating the need to walk each client through technical email settings.
This approach would also shift deliverability responsibility to us, reducing Xero's support load.
It’s a win-win:
Clients reliably receive invoices.
We have full control and visibility over email deliverability.
Fewer support tickets for Xero.
-
Nigel Smith commented
Presently having to phone the recipient of each and every quote / invoice / purchase order to make sure they have received it and that it has not been junked. Having a bounce notification only lets you know that you got the address wrong, not that it arrived and got junked.
-
Kyle Spence commented
I have successfully implemented DMARC for many organizations. SPF alignment is not necessary if you have DKIM alignment! Your teams can still use a return-path pointing to Xero (to get bounce backs, NDRs, etc), we just need a custom DKIM signature to use a custom From: domain. This is essential to modern verification, you can also make it very clear to organizations that using a custom From: domain relieves your support team of any assistance to email issues.
At the very least let us use a SMTP relay... We NEED a custom From: domain. Xero has already implemented DMARC and BIMI, let us too! This is a necessity that is 5 years overdue.
-
Wajeeha Bhatti commented
Email address to send Sales invoices from xero is coming as:
messaging-service@post.xero.com.
My client wants to change it to his email i.e. Custom sending domain security
Please can you add this change, because it is causing confusion to my client's customers. -
Alex Graham commented
ridiculous that this feature doesn't exist - several clients complain that they don't trust quotes or invoices not coming from a company email address and flag them as spam
-
Ben Fairless commented
This appears to be a relatively basic feature that all other accounting platforms have. I don’t understand why this is so hard to implement.
-
Brendan Carmichael commented
Lack of mail authentication support (SPF/DKIM/DMARC) is significant enough for me to strongly recommend against Xero to anyone considering it.
-
Nicole Reilly commented
As a partner, this issue is a major blocker to my recommending Xero as a solution for my clients over other accounting software.
All have this feature except Xero!
Late Payments are bad enough for business, without this unneccessary extra hurdle.
-
MAHCA Treasurer commented
This is critical since email security is getting tighter. Just allow us to put in smtp parameters and use those.
-
Marc Paquin commented
I am surprised that this is not possible. I received recently confirmation from multiple clients that they did not receive a quote or invoice when I sent them via Xero. This is impacting our business and sales cycles.
-
Shashwat Singh commented
Send all your xero emails from your own domain in just 2 mins. Watch demo : https://www.youtube.com/watch?v=MNsvdL-ppls (No need for multiple tools, relay systems, or complicated setup)
Contact : https://www.xeroemail.com.
-
akshay Singh commented
I think this can help: https://www.youtube.com/watch?v=QaIJw5M2rGE&t=1s (Very simple to use, takes just 5 mins to setup and it takes care of the rest). Sends all your xero emails from your own domain.
-
Michael Pepera commented
I'm having significant problems getting my invoices submitted to a large corporation whose IT department has no intention of whitelisting Xero's email server.
It is absolutely unacceptable that Xero has stated that they have no intention of implementing this feature. We pay a subscription service so that Xero can continually update the product and maintain compliance with industry security and accounting requirements.
-
Jake Cormier commented
So many of our invoices are going to spam now, because Xero stupidly uses one email address for sending out all their customers invoices across the world. So if one xero customer abuses this and gets labeled as spam, we all suffer.
Xero absolutely needs to make this a priority.
-
Victoria Buyers commented
+1
Please resolve this to stop invoice emails going to the junk folder. -
Kevin Gallagher commented
Agreed on this. We are starting to get rejected invoice emails from some of our customers. They have no reason to recognize a Xero domain name.
-
Chris Foottit commented
Why hasn't this happened yet?!