# How do you authenticate third-party senders with SPF, DKIM and DMARC?

URL: https://iblockspam.com/blog/authenticate-third-party-senders-spf-dkim-dmarc
Last updated: 2026-10-12
Published: 2026-10-12
Topic: SPF, DKIM & DMARC
Author: iBlockSpam Team

> Make CRMs, helpdesks, newsletters and invoicing tools pass DMARC: inventory senders, set up aligned DKIM and return-path, or move them to a subdomain.

## Short answer

To authenticate a third-party sender, have it sign DKIM with your domain (d=yourdomain) using records it gives you, and set a custom return-path on your domain so SPF aligns too. If it can't do either, send from a subdomain it can authenticate, or have it use its own domain. Then confirm in DMARC reports before enforcing.

Your CRM, helpdesk, newsletter platform, invoicing tool and website forms all send email that says it's from your domain. Each one has to pass DMARC on its own, or receivers will junk or reject its mail once you enforce a policy. This guide gives you a repeatable way to authenticate every third-party sender, and what to do with the ones that can't be fixed.

## What is a third-party sender?

A third-party sender is any service outside your own mail platform that sends email with your domain in the From address. Typical examples are marketing platforms, transactional email APIs, CRMs, support desks, payroll and invoicing systems, e-signature tools, and website or e-commerce plugins.

Your main mailbox provider, such as Microsoft 365 or Google Workspace, is usually set up once. Third-party senders are where DMARC projects stall, because each one is configured in a different admin panel, often by a different team. [RFC 9989](https://www.rfc-editor.org/rfc/rfc9989.html), the current DMARC standard, says DMARC "does not preclude" third parties sending for you, but adds that there is "no generally accepted mechanism" for a domain to list third-party signing domains it authorizes. Every service has to authenticate as your domain itself.

## Why does a third-party sender fail DMARC when SPF passes?

A third-party sender usually fails DMARC because it authenticates as its own domain, not yours. DMARC needs SPF or DKIM to pass for a domain that **aligns** with the From address, meaning the same domain or, under the default relaxed mode, the same organizational domain. See [DMARC alignment: relaxed vs strict](https://iblockspam.com/blog/dmarc-alignment-relaxed-vs-strict) for the details.

Here is a typical result from a service that hasn't been configured. The header is an example:

```
Authentication-Results: mx.example.net;
  spf=pass smtp.mailfrom=bounces.mailservice.example;
  dkim=pass header.d=mailservice.example;
  dmarc=fail header.from=yourcompany.com
```

Both checks passed, but for `mailservice.example`. Neither matches `yourcompany.com`, so DMARC fails. [Microsoft's DMARC guidance](https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dmarc-configure) describes exactly this pattern: SPF passes for the service's domain "but DMARC fails" because the MAIL FROM uses the service's domain and there's no DKIM signing with yours.

| What the service does | SPF aligned? | DKIM aligned? | DMARC result |
|---|---|---|---|
| Its own bounce domain, its own DKIM | No | No | Fail |
| Its own bounce domain, DKIM with `d=yourcompany.com` | No | Yes | Pass |
| Custom return-path on `bounce.yourcompany.com`, its own DKIM | Yes (relaxed) | No | Pass |
| Custom return-path and DKIM with your domain | Yes | Yes | Pass, with a backup |
| Sends from `notify.yourcompany.com` with DKIM `d=notify.yourcompany.com` | Depends on setup | Yes | Pass |

## How do I find all my third-party senders?

The fastest way to find every third-party sender is to read your DMARC aggregate reports. Publish a DMARC record with a reporting address, such as `v=DMARC1; p=none; rua=mailto:dmarc@yourcompany.com`, and receivers will send daily XML summaries of who sent mail as your domain.

Then combine three sources:

1. **DMARC reports.** Look for IPs with healthy volume that fail alignment. Our guide to [unknown sources in DMARC reports](https://iblockspam.com/blog/unknown-sources-in-dmarc-reports) explains how to identify each one, and the [DMARC Report Analyzer](https://iblockspam.com/tools/dmarc-report-analyzer) turns the XML into a readable table.
2. **Your SPF record.** Every `include` is a service someone once set up. Some may no longer be in use.
3. **People.** Ask finance, sales, support, marketing and HR which tools send email to customers, staff or suppliers. Check expense reports and card statements for SaaS subscriptions.

Record each sender in a simple inventory: service name, owner, From addresses used, purpose and current authentication status. You'll use it again when you review vendors each year.

## What are the options for authenticating a third-party sender?

There are four ways to make a third-party sender pass DMARC. Use them in this order.

### 1. Aligned DKIM with your domain (preferred)

Most email services can sign with your domain once you publish records they give you. This is usually called domain authentication, sender authentication or a verified sending domain. Many services give you CNAME records under `_domainkey` that point to keys they host and rotate. For example, SendGrid uses `s1._domainkey` and `s2._domainkey` CNAMEs, and HubSpot uses two `hs1-`/`hs2-` CNAMEs; our [DKIM records by provider](https://iblockspam.com/dkim) pages list the exact values for common services.

The resulting signature carries `d=yourcompany.com`, which [RFC 6376](https://www.rfc-editor.org/rfc/rfc6376.html) defines as the domain "claiming responsibility" for the message. DKIM is the better alignment path because it usually survives forwarding as long as the message isn't modified, while SPF breaks when a forwarder relays the message from its own servers.

### 2. Custom return-path (aligned SPF)

A custom return-path, also called a custom MAIL FROM or bounce domain, makes the service use a subdomain of yours, such as `bounce.yourcompany.com`, as the envelope sender. You usually publish a CNAME or an MX and SPF record on that subdomain. Under relaxed alignment, SPF then aligns with `yourcompany.com`.

Notice that the SPF check happens on the return-path subdomain, not on your main domain. That's why adding the vendor's `include` to your root SPF record often does nothing for DMARC.

### 3. A dedicated sending subdomain

If a service can authenticate only one domain per account, or you want its reputation kept apart from staff mail, send from a subdomain such as `news.yourcompany.com` or `billing.yourcompany.com`. Microsoft recommends subdomains for "email services that aren't under your direct control (for example, bulk email services)". The subdomain gets its own DKIM and SPF, and inherits your DMARC policy unless you publish a separate one. See [separate subdomains for marketing and transactional email](https://iblockspam.com/blog/separate-subdomains-transactional-marketing-email) for layout ideas.

### 4. Let the service use its own domain

Some tools can't authenticate your domain at all. In that case, have them send From their own domain, with your company name in the display name and a Reply-To address on your domain. Replies still reach you, and the mail passes DMARC for the service's domain. It's honest and it works.

## How do I set up a third-party sender, step by step?

Use this procedure for each service in your inventory. It follows the decision path in [Microsoft's DMARC troubleshooting guidance](https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dmarc-configure): fix MAIL FROM if you can, then DKIM, then a subdomain.

1. **Decide whether it should send as your domain at all.** Low-volume notifications nobody replies to can often use the vendor's own domain.
2. **Find the domain authentication page** in the service's settings. Search its help center for "domain authentication", "DKIM" or "custom return-path".
3. **Choose the From domain**: your main domain or a subdomain you've reserved for this service.
4. **Publish the DKIM records** the service gives you exactly as shown. Watch for DNS hosts that append your domain to the host name a second time.
5. **Publish the return-path record** if the service offers one.
6. **Update SPF only if needed.** Add the vendor's `include` only where the vendor's servers send with your domain as the envelope sender. [RFC 7208](https://www.rfc-editor.org/rfc/rfc7208.html#section-4.6.4) limits SPF to 10 DNS-querying terms, and in our [Tranco top 1,000 scan](https://iblockspam.com/research/email-security-top-1000), 22 domains already broke that limit. See [SPF too many DNS lookups](https://iblockspam.com/blog/spf-too-many-dns-lookups).
7. **Click verify** in the service and wait for it to confirm the records.
8. **Send a test** to an outside mailbox and open the headers in the [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer). You want `dkim=pass` with `header.d=` set to your domain or subdomain, and `dmarc=pass`.
9. **Confirm in DMARC reports** a few days later that the service's IPs now pass aligned DKIM at every receiver.
10. **Record it** in your sender inventory, including who owns the account.

## What DNS records will a third-party sender ask for?

A third-party sender will normally ask for two to four DNS records. These examples use placeholder values; always copy the real ones from the service:

| Purpose | Type | Example host | Example value |
|---|---|---|---|
| DKIM key (hosted by the service) | CNAME | `s1._domainkey.yourcompany.com` | `s1.domainkey.u12345.wl001.mailservice.example` |
| DKIM key (published by you) | TXT | `m1._domainkey.yourcompany.com` | `v=DKIM1; k=rsa; p=MIIBIjANBg...` |
| Custom return-path | CNAME | `bounce.yourcompany.com` | `u12345.wl001.mailservice.example` |
| SPF for the return-path subdomain | TXT | `bounce.yourcompany.com` | `v=spf1 include:spf.mailservice.example ~all` |
| Domain verification | TXT | `yourcompany.com` | `mailservice-verification=abc123` |

CNAME-hosted keys are easier to maintain, because the service can rotate keys without you touching DNS. TXT keys put you in charge of rotation; [DKIM key rotation](https://iblockspam.com/blog/dkim-key-rotation) covers how. Check any selector with the [DKIM Checker](https://iblockspam.com/tools/dkim-checker).

## When is it safe to move to p=quarantine or p=reject?

It's safe to enforce DMARC when your reports show every legitimate third-party sender passing aligned DKIM or SPF for a few weeks in a row. Microsoft recommends a gradual rollout from `p=none` to `p=quarantine` to `p=reject`, starting with lower-volume domains or subdomains and "saving the parent domain for last".

Mailbox providers already expect this work from you. Google's [sender guidelines](https://support.google.com/mail/answer/81126) say that if you use an email service provider, you should "verify that they authenticate your domain's email with SPF and DKIM". For bulk senders, the From domain "must be aligned with either the SPF domain or the DKIM domain". Our [DMARC none to reject plan](https://iblockspam.com/blog/dmarc-none-to-reject-small-business) gives a week-by-week schedule.

## How do I keep third-party senders authenticated over time?

Keeping third-party senders authenticated is an ongoing task, because teams add tools and vendors change infrastructure. Build these habits:

- **Gate new tools.** Ask anyone buying a SaaS tool that sends email to involve IT before it goes live. Make "supports DKIM with our domain" a purchase requirement.
- **Review reports monthly.** A new failing source with real volume usually means a new tool.
- **Remove dead senders.** When you cancel a service, delete its `include`, DKIM records and return-path CNAME. A forgotten CNAME pointing at a cancelled account can be a takeover risk; see [subdomain takeover and dangling DNS](https://iblockspam.com/blog/subdomain-takeover-dangling-dns-email).
- **Watch for DNS drift.** Someone editing SPF or DMARC by mistake can break every sender at once.

## Next steps

- Run the [DMARC Checker](https://iblockspam.com/tools/dmarc-checker) on your domain and make sure a `rua` address is in place.
- Build your sender inventory from two weeks of DMARC reports, then work through the 10-step procedure one service at a time.
- If DMARC is still failing after setup, work through [why DMARC fails](https://iblockspam.com/blog/why-dmarc-fails).
- iBlockSpam's DMARC monitoring collects your aggregate reports, flags senders that need fixing and suggests when to move to quarantine and reject. Its [domain monitoring](https://iblockspam.com/features/domain-monitoring) alerts you when your SPF or DMARC record changes.

## Frequently asked questions

### Is adding a vendor's include to my SPF record enough for DMARC?

Usually not. Most services send with their own bounce domain in the envelope sender, so SPF passes for their domain, not yours, and DMARC ignores it. You need aligned DKIM (d= set to your domain) or a custom return-path on your domain. Adding the include only helps when the service actually uses your domain as the envelope sender.

### Should a third-party sender use DKIM or SPF for DMARC alignment?

Prefer DKIM. A DKIM signature with your domain in d= usually survives forwarding, doesn't use up SPF's 10-lookup budget and works however the service routes mail. Set up a custom return-path as well if the service offers it, so you have two aligned passes instead of one.

### What if a SaaS tool can't sign DKIM with my domain?

Have it send from its own domain with your name in the display name and your address in Reply-To, or point it at a subdomain such as notify.example.com that you can authorize on its own. Don't loosen your DMARC policy for one tool. If the mail matters, that tool may not be a good fit.

### How do I find every service sending email as my domain?

Publish a DMARC record with a rua address and read the aggregate reports for two to four weeks. Each row shows a sending IP, volume and SPF and DKIM results. Match the IPs and envelope domains to services, then ask finance, sales, support and marketing which tools they use to email customers.

### Do I need a separate DMARC record for a sending subdomain?

No. A subdomain with no DMARC record of its own inherits the parent's policy. You only publish one at _dmarc.sub.example.com if you want a different policy or reporting for that subdomain, for example p=none while you onboard a new sending service.

## Sources

- [RFC 9989: DMARC, section 4.4 (Identifier Alignment Explained)](https://www.rfc-editor.org/rfc/rfc9989.html)
- [RFC 7208: Sender Policy Framework (SPF), section 4.6.4 DNS Lookup Limits](https://www.rfc-editor.org/rfc/rfc7208.html#section-4.6.4)
- [RFC 6376: DomainKeys Identified Mail (DKIM) Signatures](https://www.rfc-editor.org/rfc/rfc6376.html)
- [Microsoft Learn: Set up DMARC to validate email in Microsoft 365](https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dmarc-configure)
- [Google Workspace Admin Help: Set up DMARC](https://knowledge.workspace.google.com/admin/security/set-up-dmarc)
- [Gmail Help: Email sender guidelines](https://support.google.com/mail/answer/81126)

## Free tools for this guide

- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.
- [DKIM Checker](https://iblockspam.com/tools/dkim-checker): Validate DKIM keys by selector, including key type and strength.
- [SPF Checker](https://iblockspam.com/tools/spf-checker): Count real DNS lookups, find PermErrors, loops and risky "all" settings.
- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.

---

Source: iBlockSpam, https://iblockspam.com/blog/authenticate-third-party-senders-spf-dkim-dmarc (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt