Why do my Xero or MYOB invoices land in junk?
Scott Anderson · Last reviewed
Short answer
Your accounting software sends invoices from its servers while displaying your business name and address. Unless you have explicitly authorised it in SPF and DKIM, the receiving server sees a mismatch between who the message claims to be from and who actually sent it — and filters accordingly. Every separate sending tool needs authorising separately.
Key facts
Invoices are the highest-stakes mail a small business sends, and the least likely to be chased up when they don't arrive.
Xero lets you send invoices from your own email address, which makes authentication of that domain necessary rather than optional. Xero Central: sending from your own address ↗
Invoice and payment-redirection fraud relies on exactly this gap — a message that looks like it came from your business, with different bank details. Scamwatch ↗
This is the single most expensive version of the problem, because of what's inside the message. A newsletter that lands in junk costs you an open rate. An invoice that lands in junk costs you thirty days of cash flow and an uncomfortable phone call in which your customer is politely certain they never received it.
They're usually right. It did arrive. It's sitting in a folder nobody has opened since 2019.
What your accounting software is actually doing
When Xero, MYOB, QuickBooks or your practice-management tool emails an invoice, the message leaves that vendor's mail servers — not yours. But the From: line says your business, because that's what you and your customer both want it to say.
To a receiving server, that combination is indistinguishable from a forgery unless you have published something saying otherwise. SPF is where you say "this vendor may send as me", and DKIM is where the vendor cryptographically proves it.
Most businesses set up their main mailbox authentication and stop. The accounting package was configured by the bookkeeper, three years later, and nobody connected the two facts.
The systems that usually turn out to be sending as you
Ask a business how many tools email their customers on their behalf and you'll usually be told one or two. It's rarely fewer than five.
- Accounting
- Xero, MYOB, QuickBooks — invoices, statements, reminders.
- Payments
- Stripe, Square, PayPal receipts sent under your brand.
- Bookings
- Appointment confirmations and reminders, often the highest-volume mail a service business sends.
- Marketing
- Mailchimp, Klaviyo, ActiveCampaign, Campaign Monitor.
- Your website
- Contact forms, order confirmations, password resets — frequently relayed through an old web host.
- CRM and proposals
- Quote and proposal tools that email the client directly from inside the platform.
How to fix it
- 01
List every tool that sends under your name
Go through the list above and check each one's settings for the From: address it uses. Write the list down — this is the artefact the whole fix depends on.
- 02
Find each vendor's authentication instructions
Every reputable platform documents its SPF include and DKIM records. They're usually under a heading like "authenticate your domain" or "custom sending domain".
- 03
Add them to a single SPF record
One record, all the includes, still under ten DNS lookups. Two SPF records is a permanent error that breaks everything, including the parts that worked yesterday.
- 04
Publish each vendor's DKIM key
This is the step that survives forwarding, which matters enormously when your invoice gets forwarded from reception to accounts payable.
- 05
Verify with a real send
Send yourself a genuine invoice from the software to an address on a different provider, and check the message headers show SPF and DKIM passing with your own domain.
The alternative: send from the vendor's domain
Some platforms let you send from their domain instead, with your name as the display name and your address as the reply-to. It authenticates cleanly with no DNS work at all.
It's a legitimate option and sometimes the pragmatic one, but it has a cost: your customer sees a message from a name they don't recognise attached to a request for money. For invoices specifically, that's a trade worth thinking about — the whole point of authenticating your own domain is that the invoice looks like it came from you, and can be proved to have done.
Frequently asked
How do I know if my invoices are actually being filtered?
Send a real invoice to a test address on Gmail and another on Outlook, and open the message headers — they'll show whether SPF, DKIM and DMARC passed. Anecdotes from customers aren't reliable, because the ones who never saw it are exactly the ones who won't tell you.
My bookkeeper set this up. Should they fix it?
The fix is DNS, not accounting — it's typically whoever manages your domain or website. That split is precisely why this falls through the cracks: the person who chose the tool and the person who controls the records are rarely the same person, and neither believes it's their job.
Does this affect my invoice reminders too?
Yes, and reminders are worse. A reminder about an unpaid invoice, filtered to junk because it came from the same unauthorised sender as the original, is a debt-collection process that silently never happened.
We use a practice-management system, not Xero. Same thing?
Same mechanism exactly. Any platform that emails your clients using your name is a sender you need to authorise, whatever the industry.
Find out where your domain actually stands.
The checker reads your real records in a few seconds. The review works out whether they cover everything you send.