Do I need to add Harvest to my SPF or DMARC record?
No.
Last read from the sources at the foot of this page.
Which address does Harvest send from?
All invoices and estimates sent to your clients via Harvest will display your name as the sender, but they must come from [email protected]
Harvest says in its own documentation that this email comes from [email protected]. That is Harvest's own domain, so the email is checked against Harvest's records, not yours.
Why does my DMARC record not cover these emails?
Author Domain: The domain name of the apparent author, as extracted from the RFC5322.From field.
DMARC is read for the domain in the From address a reader sees. When that domain is Harvest's, the check uses Harvest's records.
So your policy, from p=none to p=reject, has no effect on these emails. There is nothing to add to your SPF record for them.
What should I watch for with Harvest email?
A forged email can copy the look of a Harvest message from any address. Read the address it came from, not the name shown, before you open a link or make a payment.
Where does this come from?
- Harvest: Can my invoices and estimates be sent from my email address?support.getharvest.comRead 14 October 2026
- RFC 7489, DMARCrfc-editor.orgRead 14 October 2026
See what is open before anyone else does.
We read from outside, find each way in first, and show it with a check anyone can re-run. No access, nothing tested, no obligation.
- We read your firm from outside.
- You see what is open, with the proof for the lead finding.
- If it is worth it, you order.
What happens if you go ahead. More at getleaktrace.com/see-it-first/.
Read the transcript
- 72 hours. One domain. Nothing to install.
- Discover. Every way in, found from outside.
- Validate. Every finding, proven. Dated and checkable by anyone.
- Close. Forged email: one click per step, where we reach your DNS host and you approve it.
- You get the fix for the rest, step by step, and we re-check until it is closed.
- Monitor. On monitoring: email settings, look-alikes and new host names re-checked every hour. Alerts within the hour.
- Every paid assessment is human-verified before release.
- The AI defense layer for businesses. getleaktrace.com/see-it-first/