Do I need to add FreshBooks to my SPF or DMARC record?
No.
Last read from the sources at the foot of this page.
Which address does FreshBooks send from?
Emails sent from FreshBooks are delivered through our mail delivery services, and come from either of these domain email addresses: @fb02.freshbooks.com @fb05.freshbooks.com @freshbooks.com
FreshBooks says in its own documentation that this email comes from @fb02.freshbooks.com, @fb05.freshbooks.com or @freshbooks.com. That is FreshBooks' own domain, so the email is checked against FreshBooks' records, not yours.
Why does my DMARC record not cover these emails?
Author Domain: The domain name of the apparent author, as extracted from the RFC5322.From field.
DMARC is read for the domain in the From address a reader sees. When that domain is FreshBooks', the check uses FreshBooks' records.
So your policy, from p=none to p=reject, has no effect on these emails. There is nothing to add to your SPF record for them.
What should I watch for with FreshBooks email?
A forged email can copy the look of a FreshBooks message from any address. Read the address it came from, not the name shown, before you open a link or make a payment.
Where does this come from?
- FreshBooks: What emails are sent out of my account?support.freshbooks.comRead 14 October 2026
- FreshBooks: How do I manage my email customization?support.freshbooks.comRead 14 October 2026
- RFC 7489, DMARCrfc-editor.orgRead 14 October 2026
See what is open before anyone else does.
We read from outside, find each way in first, and show it with a check anyone can re-run. No access, nothing tested, no obligation.
- We read your firm from outside.
- You see what is open, with the proof for the lead finding.
- If it is worth it, you order.
What happens if you go ahead. More at getleaktrace.com/see-it-first/.
Read the transcript
- 72 hours. One domain. Nothing to install.
- Discover. Every way in, found from outside.
- Validate. Every finding, proven. Dated and checkable by anyone.
- Close. Forged email: one click per step, where we reach your DNS host and you approve it.
- You get the fix for the rest, step by step, and we re-check until it is closed.
- Monitor. On monitoring: email settings, look-alikes and new host names re-checked every hour. Alerts within the hour.
- Every paid assessment is human-verified before release.
- The AI defense layer for businesses. getleaktrace.com/see-it-first/