Settings and activity
1 result found
-
482 votes
Hi everyone, we understand how frustrating it is when important emails like invoices are filtered or blocked, and how this affects customer trust and timeliness of engagement with your transactional communications. Thank you for continuing to share examples and highlighting the impact this has on your business.
We’ve made meaningful progress towards enabling email sending from your own domain. While progress is taking longer than we’d like, we can confirm that substantial backend work is underway. This work spans multiple interdependent teams across Xero, and there are still important steps we need to work through before we can release the capability to customers reliably.
As we continue to develop this capability, there are a few questions that would help our product teams ensure we’re solving the majority of our users’ needs in this space, with a reliable and secure solution.
We’d really appreciate your input on the following questions, either…
An error occurred while saving the comment 
Gavin Wilkinson
supported this idea
·
An error occurred while saving the comment Gavin Wilkinson
commented
I agree with the diagnosis that it is passing SPF/DMARC. They are also allowing the messages on a subdomain used for financial comms.
If the reason for not tackling it is to allow free trials, they could at least bump free accounts onto a different subdomain.
I understand the appropriate action is to forward any examples as an attachment to phishing@xero.com
For such a major vendor and persistent security issue, it could go to the National Cyber Security Centre (NCSC) in the UK - see if they can communicate with Xero about it.
An error occurred while saving the comment Gavin Wilkinson
commented
Here's an example of something that looks wrong and shouldn't be happening.
It's an email from xero.com but for a company recruiting for AirBnB by asking to click a link.
To me, this stuff should not come from xero.com, it's what gets our invoices blocked.
An error occurred while saving the comment Gavin Wilkinson
commented
I receive job offers saying they are from Ferrari or Chanel, etc. and when I look at the address, it is a post.xero.com address.
There is no way these places would be offering me a job and they are clearly phishing. The trouble is that I can't flag them as such because it would mess with our billing and payroll. Nightmare.
Letting us send from our domain would be ideal. I can't think of any other platforms we use that don't allow this.
This is the problem in action. Beyond service issues, such phishing is dangerous - and straight through several layers of filtering thanks to Xero's trusted domain.
Ideas for a solution are abundant in this thread. My new idea is for Xero to react constructively to the issues these emails (attached) cause.