Authenticate third-party senders

List systems by purpose and owner: mailbox provider, marketing, CRM, help desk, invoicing, payroll, recruitment and application mail.

Many platforms can sign with a customer domain after CNAME or TXT records are published. A custom return path can also provide SPF alignment.

At least one aligned path must pass DMARC. Configuring both improves resilience but does not permit a failing system to be ignored.

A dedicated subdomain can isolate reputation and policy for a sending function. It must still be authenticated, monitored and covered by an intentional DMARC policy.

Forwarding commonly breaks SPF. DKIM may survive unless an intermediary changes signed content. ARC can preserve authentication context, but receivers decide how to use it.