QuickBooks Online and SPF: there's no include to add, so here's what to check

"Our invoices from QuickBooks are going to spam. Add QuickBooks to our SPF." It's a common ticket, and the honest answer surprises clients. Intuit's QuickBooks Online help doesn't document any SPF include for a customer's domain. Adding one won't do what the client expects, and the obvious guess (include:intuit.com) can break their SPF record outright. Here's what Intuit actually documents and where an MSP can help.

How QuickBooks Online sends invoices

Intuit's help article on sending invoices says QuickBooks Online sends invoice emails "from either your QuickBooks Online account email, or from a specified Gmail address," with the invoice attached as a PDF. The two paths behave differently:

• The default path. QuickBooks sends the message through Intuit's systems. Intuit's article doesn't describe any DNS record the customer should publish for this path, and we found no Intuit help page that gives an SPF include for a customer domain.
• The connected Gmail path. You can connect one Gmail address from the invoice's From dropdown (Add Gmail address). Intuit says to make sure you select the Send email on your behalf permission when you connect it, so QuickBooks can send through that Google account. The message then goes out through Google. If that address is on a Google Workspace domain, it's the domain's existing Google SPF and DKIM setup that applies. The QuickBooks connection doesn't add anything new to SPF.

Intuit's articles don't describe an equivalent "connect your Microsoft 365 mailbox" option for QuickBooks Online invoices. We didn't verify QuickBooks Desktop's email options, so they're out of scope here.

Why an SPF include wouldn't help the default path

SPF (RFC 7208) checks the envelope sender (the Return-Path), not the From: name or reply address the customer sees. When Intuit's systems send the message with their own envelope sender, receivers check Intuit's SPF record, never the client's. An include in the client's record isn't consulted for that mail.

For DMARC (RFC 9989), what matters is the domain in the visible From: header. If that domain is Intuit's, the client's DMARC policy doesn't apply to the message. If a message ever showed the client's own domain in From: while sending from Intuit's systems, it would need an aligned SPF or DKIM pass for the client's domain. Intuit doesn't document any way to set that up. Check a real QuickBooks message's headers (From, Return-Path and Authentication-Results) rather than assuming either case.

Don't add include:intuit.com

On Oct 13, 2026, a live DNS check of intuit.com's SPF record showed it already uses ten DNS lookups internally, through nested includes for Microsoft 365, Salesforce, Zendesk, Marketo and others. Including it would cost eleven lookups by itself, over RFC 7208 §4.6.4's limit of ten. The client's SPF would return a permerror for all of their mail, including Microsoft 365 and Google. Intuit doesn't document this include for customers. It's Intuit's own corporate record. This is a DNS observation and can change.

We also saw that notification.intuit.com publishes an SPF record made up of ip4 entries. Intuit doesn't document it as something customers should include, so don't add it either.

What Intuit does recommend for delivery problems

Intuit's troubleshooting article for customers not receiving QuickBooks Online emails suggests, in order:

1. Reset your email address under Settings → Account and settings → Company → Contact info, especially after importing from QuickBooks Desktop.
2. Clear and re-enter the company email exactly, with no stray spaces. Send yourself a test, and try a recipient on a different email domain.
3. Allow-list QuickBooks Online's mail servers. Intuit publishes a list of host names (such as mailout1a.intuit.com and o1.sg.n.intuit.com) and IP addresses for "an IT expert" to add to the mail server's allow list.

For an MSP, step 3 is the useful one, but it's the recipient's filter that needs the change. If the client's own staff aren't receiving QuickBooks notifications, add Intuit's published hosts and IPs to the client's inbound filtering, whether that's Microsoft Defender, Google, or a gateway such as Mimecast or Proofpoint. If the client's customers aren't receiving invoices, those customers' IT teams are the ones who would need to allow-list.

Reading a QuickBooks invoice's headers

Ask the client to send a test invoice to a mailbox you control, then open the full headers. Three lines tell you most of what you need. From: shows which domain DMARC is evaluated against. Return-Path: shows which domain SPF was checked for. And Authentication-Results (RFC 8601) shows the receiver's spf, dkim and dmarc verdicts. If all three pass for an Intuit domain, the spam placement is about reputation or content, not the client's DNS.

A client conversation that works

"QuickBooks sends your invoices through Intuit's own mail system, so your SPF record isn't checked for them, and Intuit doesn't publish an SPF entry for customers. Adding the obvious one would actually break email for your whole domain. What we can do: check a real invoice's headers to see what's failing, make sure your company email in QuickBooks is clean, allow-list Intuit's servers on your side, and, if you use Google Workspace, connect your Gmail address so invoices go out through your authenticated Google setup."

Check the client's SPF now

Run the free SPF checker →

It walks the include tree, counts DNS lookups against the RFC 7208 limit of 10, and flags duplicate records, permerrors, and +all or ?all endings, which is useful after someone has "helpfully" added an include.

Founding Partner: $1,999, one time. Catch the well-meant DNS edits that break a client's SPF, with weekly rescans and change alerts across 50 domains. Founding Partner covers 50 client domains with full branding (logo and colors), weekly rescans and change alerts, unlimited Security Briefs (150 prospect scans a month), the Grow toolkit, the Policy library, a branded service menu, webhooks, the API, and MCP access (except quote drafts). If you later subscribe to Pro, you pay $299/mo instead of $399 for as long as that Pro subscription stays active. The offer is capped at 50 seats and closes on Dec 15, 2026, or when all 50 seats are claimed, whichever comes first. Proposals and the Service Library require Pro. Founding Partner is non-refundable, except that you're refunded if the seats run out before your payment can be fulfilled.

See Founding Partner details →