How to Make DMARC Work with Third-Party Email Senders

Why Third-Party Senders Break DMARC

When you delegate email sending to a third-party provider, your DMARC record starts failing - even if nothing else changed. Here is why.

DMARC requires that at least one of two checks passes: SPF or DKIM. And the domain in the SPF result or DKIM signature must align with the domain in the email's From header. If a marketing platform or SaaS tool sends email on your behalf using its own infrastructure, SPF points to the ESP's IPs and DKIM is signed with the ESP's domain. Neither matches your From domain. Alignment fails. DMARC fails.

The fix is not to weaken your DMARC policy. It is to make the third-party sender authenticate in a way that actually aligns with your domain.

Option 1 - Custom DKIM with Your Domain

Custom DKIM means your ESP signs outgoing mail with a DKIM key that belongs to your domain. When a mailbox provider checks the DKIM signature, it sees your domain in the signature header and it sees your domain in the From header. Alignment passes.

How custom DKIM works in practice: your ESP generates a DKIM key pair and gives you the public key. You publish it as a DKIM record in your domain's DNS. The ESP then signs every outgoing message with the matching private key. From the mailbox provider's perspective, the email originated from your domain and was signed by your domain. DMARC passes.

This is the cleanest solution for most setups. Your main domain stays the single sending identity. You do not need separate subdomains for different senders. Your DMARC policy can remain at p=reject without affecting legitimate ESP traffic.

Not every ESP supports custom DKIM signing. The major ones that do include SendGrid, Mailgun, Amazon SES (with custom DKIM), and Postmark. If your current provider does not offer it, this is worth evaluating as a switching criterion.

Option 2 - What If My ESP Does Not Support Custom DKIM?

If your provider does not offer custom DKIM signing, the practical alternative is a dedicated sending subdomain. You create a subdomain such as sends.example.com, delegate SPF to your ESP for that subdomain, and publish a separate DMARC record for it. Emails sent through the ESP show the subdomain in the From header, so SPF or DKIM alignment passes on the subdomain even though the authentication belongs to the ESP.

This approach works but adds operational overhead. Each distinct sending flow - marketing platform, CRM, transactional system - needs its own subdomain. You end up managing multiple sending identities and tracking them separately in your DMARC reports.

Option 3 - ESPs That Handle Alignment Automatically

Some email providers have pre-arranged trust relationships with major mailbox providers. They manage DKIM keys in a way that satisfies alignment without requiring you to publish your own DKIM record. SendGrid, Mailgun, and Amazon SES offer this through a DNS toggle rather than a custom key upload.

If your ESP offers an alignment feature, confirm whether it works through the provider's existing trust chain or whether it still requires a DNS record tied to your domain. The latter is preferable because it keeps authentication tied to your domain rather than relying on the ESP's relationship with mailbox providers.

How to Check Whether Your ESP Setup Is Working

Aggregate DMARC reports are the primary tool here. After implementing custom DKIM or changing your sending subdomain setup, you need to confirm that alignment failures on the ESP's IPs decrease or disappear.

The report format is standardized XML (RFC 5961), but most people do not read it raw. You want a tool that parses it into a daily summary. DMARCFlow's aggregate report view breaks down failures by source IP and shows DKIM and SPF results per IP, so you can tell whether a specific ESP's IPs are now aligned or still failing. If you set up custom DKIM and two weeks later the ESP's IPs are still showing alignment failures, the DKIM record was not published correctly or the ESP is not signing with the right key selector.

If you are relying on a sending subdomain approach, daily reports are even more important. You will have multiple sending identities in play - your main domain at p=reject and your sending subdomain with its own policy. Without per-IP breakdown reporting, you cannot tell which sending flow is responsible for any failures that appear.

Common Mistakes to Avoid

Setting p=none to make the problem go away is the most common mistake. When you set p=none, mailbox providers take no action on failing messages. You stop seeing rejections, but you also stop protecting your domain. Anyone can spoof your domain and messages will still be delivered. p=none is a monitoring tool, not a solution to alignment failures.

Another mistake is using multiple ESPs without tracking them separately. If you send marketing through one provider and transactional email through another, both appear in your DMARC reports. If one is misconfigured, you need to be able to identify which one. Give each sending flow its own sending subdomain or use a reporting tool that isolates each IP range.

A third mistake is implementing custom DKIM but not verifying it before moving to p=reject. DKIM key rotation is handled by the ESP, not by you. Some ESPs rotate keys on a 90-day schedule. Always check aggregate reports for at least one full rotation cycle - typically a week after implementation, then again two to four weeks later - before tightening your main domain policy.

FAQ

Can I add the ESP's DKIM key to my domain DNS?

You do not add the ESP's DKIM key to your DNS. The ESP generates a key pair and gives you the public half to publish. You cannot simply add an external ESP's DKIM selector because the private key stays with the ESP. What you control is the DNS record that publishes the public key the ESP generated specifically for your domain.

Does SPF cover third-party senders automatically?

No. SPF authorizes IP addresses to send mail for a domain. If your ESP's IPs are not in your SPF record, SPF fails. If they are in your SPF record but the email's From domain does not match the SPF domain, alignment fails. SPF is necessary but not sufficient for DMARC compliance with third-party senders.

How long does custom DKIM setup take?

Custom DKIM setup typically takes 24 to 72 hours end to end. DNS propagation can take up to 48 hours after you publish the record, because DKIM lookups are cached by recursive resolvers. The ESP-side configuration is usually a DNS record and a verification ping. Some providers activate signing immediately after verification; others wait until propagation completes.

How do I check if my ESP supports custom DKIM signing?

Check the ESP's documentation for "custom DKIM," "dedicated DKIM," or "bring your own DKIM." Most major providers support it. If the ESP does not support it and you need it, consider it a switching signal - the cost of managing sending subdomains or accepting alignment failures is higher than moving to a provider that handles it properly.

Bottom Line

Third-party senders fail DMARC alignment by default because they authenticate with their own domain, not yours. The fix is to have the ESP sign with your domain's DKIM key, route ESP traffic through a dedicated sending subdomain with its own DMARC record, or use an ESP that handles alignment on your behalf. Whichever approach you choose, validate it using aggregate DMARC reports before moving your main domain policy to p=reject.

If you want daily aggregate reports with per-IP breakdowns so you can confirm your ESP setup is working correctly, DMARCFlow provides this as part of its monitoring service. The report view makes it straightforward to spot which IPs are aligned and which are still failing after a configuration change.