When a vendor cannot align

Some platforms cannot be made to align. Not will not — cannot: no custom return-path, no customer-domain DKIM, and no intention of adding either. Every estate has one, and it is usually finance software nobody is allowed to replace.

Confirm it first

"The vendor says it is not possible" is frequently first-line support reading a script. Before you design around it:

Search their documentation for the four names from the previous lesson — the feature is often present under a term nobody recognised.
Ask specifically whether they support DKIM signing with the customer’s domain. That is a different question from the return-path one and is sometimes answered differently.
Ask in writing, and keep the answer. It is what justifies the workaround to whoever asks later.

Four options, worst to best

Option	What happens	When it is right
Leave it failing	The mail fails DMARC. At enforcement it is quarantined or rejected.	Only if the mail is genuinely unimportant — and then ask why it is being sent.
Hold the whole domain at p=none	Nothing is protected, anywhere, because of one vendor.	Never. This is the option to argue against.
Move it to its own subdomain	From becomes `@billing.acme.com`. It aligns there, and the parent can still enforce.	Usually the answer.
Replace the vendor	Solved permanently.	At renewal, with this on the list.

The subdomain workaround

Give the vendor a subdomain and let it be authoritative there. The visible From address changes, which is the real cost and the reason it needs a conversation rather than a change ticket.

billing.acme.com   TXT  "v=spf1 include:_spf.vendor.example -all"
_dmarc.billing.acme.com TXT "v=DMARC1; p=none; rua=mailto:dmarc@acme.com"

acme.com           can go to p=reject without waiting for this vendor
billing.acme.com   stays at p=none until the vendor improves, or forever

The parent domain is freed. One unalignable vendor no longer holds the entire estate at p=none, which is the point.
The exposure is bounded and named. billing.acme.com is spoofable; acme.com is not. That is a far better position than the reverse, and it is a sentence you can put in a risk register.
Set sp=reject on the parent so every other subdomain is covered, then let this one carry its own weaker policy explicitly.

Do not let one vendor set the whole estate's policy

The most common outcome of an unalignable vendor is a DMARC project that stalls at p=none for two years while somebody waits for a feature request. Isolating it costs a subdomain and a visible From change; leaving it in place costs the protection of every other sender you have.

Knowledge check

A finance platform sends invoices as @acme.com, supports no custom return-path and no customer-domain DKIM. Everything else in the estate aligns. What is the best move?

Move that vendor to billing.acme.com with its own weaker policy, and take the parent domain to enforcement.
Hold acme.com at p=none until the vendor adds support.
Add the vendor’s include to acme.com so their mail passes SPF.
Set adkim=r and aspf=r so the vendor’s domain aligns under relaxed matching.

Correct — Move that vendor to billing.acme.com with its own weaker policy, and take the parent domain to enforcement. It bounds the exposure to one named subdomain and frees the rest of the estate, which is the whole point. The cost is a visible From change, which is a business conversation rather than a technical obstacle.

Not this — Hold acme.com at p=none until the vendor adds support. This is the outcome to argue against. One vendor’s roadmap ends up setting the security policy for every other sender, frequently for years.

Not this — Add the vendor’s include to acme.com so their mail passes SPF. It makes SPF pass for the vendor’s own envelope domain and does nothing for alignment, because your record is never consulted for their mail. This is the wasted afternoon from the previous lesson.

Not this — Set adkim=r and aspf=r so the vendor’s domain aligns under relaxed matching. Relaxed alignment compares organisational domains. The vendor’s domain does not share one with acme.com, so relaxed changes nothing — it is already the default.

Confirm it first

Four options, worst to best

The subdomain workaround

Try it on a real domain