Enter your idea

Vicki Carlisle makes an excellent request.

The ability to BCC messages to an internal mailbox/address of the sending domain is important. This can give reassurance messages are sent, helps create an off platform archive, etc.

(Vicki said: "Just adding I would like ALL communications from me to (a) be from an email address I choose; and (b) I need to retain a FULL COPY of all messages and content as well.")

1. Admin only.
2. Yes. Feature should allow the user to determine what the sending address is based on their own requirements/preferences.
3. Allow it as an option.

Also, this basic security "feature" had better be included as standard for all Xero plans, and not as some extra paid premium add-on.

1. Administrator only management is probably the right way to go for setting up and maintaining. But ideally Xero's entire permissions/roles UI would allow for granular control of which individual features, and admin functions, are available to each user.

2. Yes, of course. One should be able to choose a default "From" address in email setting (and/or invoice settings) and be able to select the "From" address at the time of sending Invoices, Statements, Receipts, Quotes, etc.

3. Yes.

I also agree with the points made by:

- Adam Romain (October 21, 2026 3:02 AM)
- Simon White (October 21, 2026 4:53 AM)
- Perry Paolantonio (October 21, 2026 8:05 AM)
- Ryan Freeman (October 21, 2026 9:49 AM) (Specifically: Also allowing us to use any SMTP provider)
- Dennis Seyersdahl (October 21, 2026 12:17 PM)
- George Aretakis (October 22, 2026 10:48 AM)

Just adding I would like ALL communications from me to (a) be from an email address I choose; and (b) I need to retain a FULL COPY of all messages and content as well.

This includes via Xero Ask and Tax returns, document packs etc.

This is a professional requirement, and I have been asking for visibility and copies of my outgoing communications for years. It is a professional requirement.

Within your Xero account would you want multiple Users to be able to manage custom email domain settings, or just Administrators? Administrators only

Does your domain have more than one mailbox associated with it? Yes

Would you want to use the same domain across more than one Xero organisation? Potentially yes - give us the option.

Q: Within your Xero account would you want multiple Users to be able to manage custom email domain settings, or just Administrators?
A: JUST ADMINISTRATORS
Q: Does your domain have more than one mailbox associated with it?
YES
Q: Would you want to use the same domain across more than one Xero organisation?
A: NO

Thanks for progressing this feature.

I'd very much welcome the ability to send emails directly from our own domain, ideally with a straightforward setup using SPF/DKIM authentication via DNS records, without needing to connect individual mailboxes.

I use multiple Microsoft Exchange email addresses and aliases on my domain.

My preferences would be:

1. Simple setup: Domain authentication through SPF/DKIM (and CNAME records where appropriate) should be quick and easy to configure, without requiring additional software, mailbox connections or licences. Sending from aliases or shared mailbox addresses should be supported without additional authentication.

2. Address-level restrictions: Although SPF/DKIM authenticate a domain rather than individual addresses, I'd like administrators to be able to specify exactly which email addresses Xero is permitted to send from. This restriction would need to be enforced within Xero itself, since DNS authentication cannot restrict sending to individual addresses.

3. Administrator control: Only administrators should be able to manage approved sender addresses and permissions. Other users should only be able to select from addresses explicitly authorised for them.

4. Additional safeguards: Configurable Reply-To addresses, verification when adding new sender addresses, an audit trail of configuration changes and the ability to revoke sending permissions would all be welcome.

The priority for me is simplicity without compromising security: Easy DNS-based authentication, combined with controls enforced within Xero that restrict sending to specifically authorised addresses.

This would allow businesses to benefit from professional, domain-authenticated email delivery while protecting other email identities on their domain.

Finally!!!

Only admins should be able to manage custom domain settings.

Just about every businesses with a custom domain is going to have multiple mailboxes. BUT many of us also have generic addresses (sales@acme.com, etc) that often go to shared mailboxes multiple people monitor, etc.

In our case, we would likely have all our quotes and invoices go out from our sales@....com email address. But I suspect some other groups might want them to be sent from whatever Xero user is sending the invoice. It should provide for that flexibility.

Goes without saying that this has to have full SPF/DKIM (via CNAME) support

Within your Xero account would you want multiple Users to be able to manage custom email domain settings, or just Administrators?

Dont mind either or

Does your domain have more than one mailbox associated with it?

Yes, we also have two domain names

Would you want to use the same domain across more than one Xero organisation?

I would like 2 domain names across one organisation

I would also like to have a history log or email audit
So i can rely on this should i need proof when and where an email was sent, snd the history of the document.

- Within your Xero account would you want multiple Users to be able to manage custom email domain settings, or just Administrators?

Administrators/Subscriber

- Does your domain have more than one mailbox associated with it?

Yes, but we can have a specific mail to send from in Xero. Some bigger companies may have separate AP and AR emails.

- Would you want to use the same domain across more than one Xero organisation?

No

Great news!

• Within your Xero account would you want multiple Users to be able to manage custom email domain settings, or just Administrators?

Admin

• Does your domain have more than one mailbox associated with it?

One

• Would you want to use the same domain across more than one Xero organisation?

No

Thankyou.

1. Admin
2. Yes multiple brands within a company / multiple responsibilities accross the templates, even multiple people responsible for sales within a department (not everyone is an email administrator)
3. Yes, Franchised Businesses who use a single domain for email (centrally managed) would all be running multiple Xero Orgs.

Thanks for the update. This feature cannot come soon enough. To answer your questions:

1. Just Admins
2. Yes
3. Not at this time, low priority feature.

I'm so glad to hear there is progress. Spam filtering of Xero emails has gotten so bad that we have gone back to downloading the invoices from Xero so we can manually email them as attachments to our customers. For us, what's most important is that your solution works with Google Workspace as that's how our organization manages our email. Obviously Microsoft and other providers will be critical for other users. What we don't want is a situation where we have to delegate Xero as our domain mail server and/or where Xero tries to send the mail (from us) through their servers, as those will still get spam filtered. We want to configure Xero to send through our existing mail infrastructure. You can look to many CRM and similar SaaS software for examples that handle this mail integration well. Regarding your specific questions:

* Limiting the settings to Administrators seems simplest and works well for us.
* Our domain has many mailboxes, but we would be fine with using just one (sales@ourdomain) for outgoing Xero emails.
* If we had more than one Xero organization (and we might in the future), we would prefer that each could specify their own domains.

Thanks for actioning this. We were close to losing hope with Xero.

Within your Xero account would you want multiple Users to be able to manage custom email domain settings, or just Administrators?
Admin Only

Does your domain have more than one mailbox associated with it?
Yes

Would you want to use the same domain across more than one Xero organisation?
Not at this time, but would appreciate the functionality as an option.

Within your Xero account would you want multiple Users to be able to manage custom email domain settings, or just Administrators?
• Admin only

Does your domain have more than one mailbox associated with it?

• Yes, quotes should come from sales@ while invoices, statements etc accounts@ anything internal like Expenses can also be from accounts@

Would you want to use the same domain across more than one Xero organisation?

• We only have one org, so not needed for us.

I agree this should not be complicated. Unfortunately, this discussion has become unnecessarily complex and moved beyond the actual request.

**The request is simple: Each Xero organization should be able to configure its own authenticated email domain for invoices, statements, and payment reminders.**

This should be an organization-level setting, not tied globally to a user's account. Users managing multiple organizations should have separate sending addresses for each business.

**This is established industry practice, not new technology.**

Zendesk, Salesforce, HubSpot, Microsoft 365, SendGrid, and Amazon SES already support authenticated business-domain email delivery in various forms.

SPF, DKIM, DMARC, and domain verification are established standards. Configuration should involve entering the sending address, verifying domain ownership through DNS, and saving.

**Cybersecurity and customer expectations have changed.**

As an IT services provider, we train clients to identify phishing, fraudulent invoices, and suspicious financial communications. A fundamental recommendation is verifying the sender's domain before processing invoices or clicking payment links.

Yet Xero's approach creates exactly the situation we teach customers to question.

A customer expecting an invoice from a recognized business domain instead receives one from an unfamiliar Xero domain. They may delete it, report it as phishing, or delay payment.

**We should not have to choose between cybersecurity best practices and successfully delivering invoices.**

**Bad actors can potentially create legitimate Xero accounts to distribute fraudulent invoices.**

A malicious actor could create a Xero organization impersonating a legitimate business and send fraudulent invoices through Xero's infrastructure.

These emails may pass SPF, DKIM, and DMARC authentication despite being fraudulent.

**Email authentication verifies authorized sending infrastructure, not the legitimacy of the business or invoice.**

I am not suggesting Xero lacks fraud prevention controls. However, legitimate platforms can be abused before malicious activity is identified.

When legitimate and fraudulent organizations use the same platform domain, recipients have fewer ways to distinguish trusted communications.

Using verified business domains adds an identity verification layer. It does not eliminate fraud but improves security.

**This raises questions about security responsibility and potential liability.**

When Xero requires businesses to use its email infrastructure, Xero controls a critical component of financial communications.

What happens if Xero's infrastructure is compromised or fraudulent invoices are distributed through its platform? Who is responsible if security failures contribute to financial losses?

**If Xero requires customers to use its infrastructure, it must recognize the associated security responsibilities.**

Legal liability depends on applicable laws, contracts, and circumstances. Customers deserve clarity about Xero's responsibilities when using infrastructure they cannot control.

Allowing businesses to authenticate their own domains creates clearer shared responsibility. Businesses manage their domains and authentication; Xero remains responsible for securing its platform.

**Businesses should control their email identity rather than having Xero make that decision for them.**

As an IT services provider, I implement SPF, DKIM, DMARC, and phishing prevention for clients. Yet Xero limits our ability to apply those same controls to financial communications.

**The requested solution is straightforward:**

1. Configure a sending address for each organization.
2. Verify domain ownership through DNS.
3. Support SPF, DKIM, and DMARC alignment.
4. Automatically use the correct authenticated domain.
5. Retain Xero's default email service as an option.

We are not asking Xero to become an email hosting provider, only to support an established capability.

**I would appreciate direct answers from Xero:**

1. Does Xero support authenticated outgoing domains per organization?
2. If not, is this planned, and when?
3. If not planned, what is the justification?
4. What responsibility does Xero accept if its infrastructure or security controls fail and contribute to financial losses?

I am not looking for forwarding instructions, Outlook workarounds, or third-party automation.

**This is not simply branding. It is a cybersecurity, deliverability, and accountability issue.**

Why is authenticated, organization-specific email identity not considered a fundamental requirement for a modern financial platform?

I would appreciate a direct response from Xero's product development team addressing this request rather than continuing to complicate an established industry practice.

Within your Xero account would you want multiple Users to be able to manage custom email domain settings, or just Administrators? - Just administrators.

Does your domain have more than one mailbox associated with it? - Yes

Would you want to use the same domain across more than one Xero organisation? Possibly

1)Within your Xero account would you want multiple Users to be able to manage custom email domain settings, or just Administrators?
- only admin for us, though I do understand why a larger team might want to allow an IT person or 3rd party contractor to manage email settings without accessing financial details.

2) Does your domain have more than one mailbox associated with it?
- per person and role-based
- we would send from one role-based company email
- can provide valid SMTP info if needed, or Google Workspace integration

3) Would you want to use the same domain across more than one Xero organisation?
- Yes, our American and Canadian companies use the same domain

+1 to what Jonathan said: "what we need is a way to authenticate our domain with DNS records (DKIM, SPF) so we can simply choose our own service to send the emails. Any mid-sized business who need this stuff can set this up in 5 minutes with their IT company."

Beyond that, just let me use my own SMTP! No DNS required. Works with any service.
- Google Workspace with an app password
- AWS
- SMTP2GO (or any 3rd party SMTP)
- literally any email service that offers password-based SMTP

Just let us fill in the fields and we're golden.

Finally! Good news.

1. Administrator only
2. Yes, per person and shared mailboxes
3. No, one domain per Xero organisation only.