A vendor signing their own domain gives you a dkim=pass that does nothing for DMARC. Getting them to sign as you is one setting on their side and one record on yours, and the only proof it worked is in a delivered message.
What changes
| Before | After | |
|---|---|---|
| DKIM-Signature d= | mailer.vendor.example | example.com |
| DKIM result | pass | pass |
| Aligned with From: example.com | No | Yes |
| DMARC | Fails unless SPF aligns | Passes |
| Survives forwarding | Irrelevant — it never aligned | Yes |
Only the third row changed, and it is the only row DMARC reads.
Doing it
- Find the setting. Vendors call it “authenticated domain”, “sending domain”, “branded links” or “domain authentication”. It is almost never called DKIM.
- Publish what they give you — a CNAME or a TXT, at a selector they choose. Use a selector that is theirs alone.
- Wait for their verification to succeed, then send a message.
- Read the delivered headers. This is the step that establishes it worked.
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=example.com; s=vendor2026; ...
^^^^^^^^^^^ your domain, not theirs
Authentication-Results: mx.receiver.example;
dkim=pass header.d=example.com header.s=vendor2026;
dmarc=pass header.from=example.comA dashboard reporting “domain verified” means they can resolve your record. It does not mean they have started using it, and the two are not always simultaneous.
Both signatures, usually
Many platforms keep signing with their own domain as well and add yours alongside. That is fine and slightly useful: two independent signatures, one of which aligns. The presence of a vendor-domain signature is not evidence that yours is missing — read every header.d in the result, not the first.
Do this before the custom return-path, if you can only do one
Aligning SPF by changing the envelope sender and aligning DKIM by changing d= both satisfy DMARC. The DKIM route survives forwarding and the SPF route does not, so it is the one worth having first. Both is better — a domain resting on a single mechanism has no margin when an intermediary breaks it.