Guide · 10-minute read
How to send invoices from your own domain.
Invoices that arrive from 'noreply@billingapp.com' look like spam to most clients. Invoices that arrive from 'you@yourcompany.com' don't. This guide walks through the three real ways to send from your own domain — SMTP, Amazon SES, Resend — and the DNS records that make any of them work properly.
Last updated May 27, 2026
Why it matters
Three things change when invoices send from your domain instead of a SaaS noreply. First: deliverability. Established domains with clean reputation hit the inbox; new SaaS noreply addresses occasionally land in spam, especially the first time a client receives mail from them. Second: trust. Clients recognize your address; they don't recognize a SaaS sender. Third: reply handling. When a client hits Reply, the reply goes to your inbox, not to a SaaS support queue that may or may not forward.
The trade-off is setup. You need a domain, a sending provider, and proper DNS records. Once it's working, it's set-and-forget.
Option 1: SMTP (works with anything)
SMTP is the lowest-common-denominator outbound email protocol. Any provider that gives you outbound mail can give you SMTP credentials. Google Workspace, Fastmail, Mailgun, Postmark, SendGrid, ProtonMail Business — all support SMTP relay.
Fields you'll provide to your billing tool: host (smtp.yourprovider.com), port (587 for STARTTLS or 465 for TLS — your provider's docs will say which), username (usually an email address or an app token), password (usually an app password or API key, not your account password).
Strengths: works with any provider, easy to set up, easy to switch. Weaknesses: slower than API-based sending, fewer deliverability signals if something goes wrong.
Option 2: Amazon SES (cheap at scale)
Amazon SES is the cheapest provider per email at any meaningful volume (~$0.10 per thousand). The setup is heavier — you need an AWS account, you verify your sending domain in the SES console, you provision IAM credentials with SES send permission, and you start in a sandbox until AWS reviews your sending case.
Worth the setup if you're sending 1,000+ emails a month or you're already on AWS. Probably overkill if you're sending under 100. Hoursmith's BYO email config asks for region, access key id, and secret access key.
Option 3: Resend (modern API, simple setup)
Resend is a newer email API service designed for developers. The setup is the lightest of the three — sign up, verify your domain via DNS records in their dashboard, generate an API key, paste into your billing tool.
Free tier covers small senders; paid plans scale to ~ $20/mo for 50k emails. The trade-off vs SES is price-per-email at very high volume, but the trade-off vs SMTP is dramatic — modern API, clean dashboard, instant deliverability signals.
The DNS records that actually matter
Three DNS records make BYO email work properly: SPF, DKIM, and DMARC. Without them, your invoice emails will land in spam regardless of which provider you use.
SPF (Sender Policy Framework): a TXT record at your apex domain that says 'these IP ranges / providers are allowed to send mail for me.' Your provider will give you the exact value to add (e.g. 'v=spf1 include:_spf.google.com ~all' for Google Workspace).
DKIM (DomainKeys Identified Mail): cryptographic signing of outbound mail. Your provider gives you 1-3 TXT records to add at specific subdomains (e.g. 'google._domainkey'). Once added, every outbound mail from your provider is signed; receivers can verify it actually came from you.
DMARC (Domain-based Message Authentication, Reporting & Conformance): a TXT record at '_dmarc.yourdomain.com' that tells receivers what to do with mail that fails SPF/DKIM. Start with 'v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com' for monitoring; tighten to 'p=quarantine' or 'p=reject' once you're confident.
Testing deliverability before you commit
Don't trust 'it sent successfully' as a deliverability test — that just confirms the SMTP/API handshake worked. Send a test to mail-tester.com (they give you a one-time inbox URL); their report grades SPF, DKIM, DMARC, and content signals. Score above 8/10 before sending real invoices.
Also test to a Gmail inbox you control and a Microsoft 365 inbox if you have access to one. Different receivers have different filtering rules; passing both is a strong sign you're set up right.
What to do when something breaks
If invoices start landing in spam, the cause is almost always one of: DKIM record missing or wrong; sending IP rotated and SPF doesn't cover it; your domain reputation took a hit from a separate issue; or your message content triggered spam filters (rare with invoices — they're usually conservative).
Most billing tools log the success/failure status of every send. If yours does, check the log first — a failed send won't reach the client at all. If sends succeed but land in spam, walk back through the DNS records and test against mail-tester.
How Hoursmith does it
How Hoursmith does it
Studio and Agency plans support all three providers — SMTP, Amazon SES, Resend — through one adapter abstraction. The Email settings page in /settings/email has a provider toggle; each provider reveals only the fields it needs. Saved credentials are encrypted with AES-256-GCM and a server-only key (EMAIL_CREDENTIAL_KEY); plaintext is never returned to the client after save.
Every BYO config has a 'Send test email' button to verify before the first real send. The email log records every send (provider used, success/failure, error if any) so you can debug deliverability issues without guessing.
System mail — password resets, invites — always routes through the platform default sender even when BYO is configured, so a misconfigured BYO can't lock out your team. Invoice / reminder / receipt mails honor BYO.