Topic starter
25/10/2026 11:02 am
TL;DR: Third-party email streams can pass SPF or DKIM without protecting the visible From domain, according to Valimail. DMARC stays fragile until mail teams map every sender, align each stream, and verify delivered headers before enforcement.
Editorial analysis by NHI Mgmt Group, based on content published by Valimail: “How to authenticate third-party email senders without hurting deliverability”.
Key questions
Q: Why do SPF and DKIM passes still leave DMARC enforcement fragile?
A: Because SPF and DKIM can validate parts of delivery without proving that the visible From domain is authorised.
Q: What are the signs that a sender inventory is incomplete?
A: Look for unexpected regional tools, internal applications, test environments, or vendor paths that still send with the brand domain but never appear in the ownership spreadsheet.
Q: How should teams govern third-party email senders under DMARC?
A: Treat each external sender as a delegated identity with an owner, a purpose, and an offboarding path.
Practitioner guidance
- Build a stream-level sender inventory Track the business purpose, owner, visible From pattern, Return-Path, DKIM domain, selector, and offboarding path for every mail stream that uses the brand domain.
- Prefer aligned DKIM for third-party mail Configure vendors to sign with a domain you control, then verify that the DKIM d= value aligns with the visible From domain in delivered messages.
- Segment vendors onto purpose-built subdomains Use separate subdomains for marketing, billing, notifications, and support so each stream has its own policy, reputation, and ownership boundary.
Bottom line: The main failure mode is confusing successful authentication with authorised use of the visible brand domain.
Glossary terms: DMARC, Return-Path, DKIM Selector, Third-Party Sender
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
27/10/2026 7:16 pm
DMARC alignment is a delegated identity problem, not just an email security problem. The article’s central point is that organisations do not merely authenticate mail, they authorise specific mail streams to use a brand identity that recipients trust. That is an identity governance issue because the sender may be a third party, but the risk and accountability remain with the domain owner. Practitioners should manage domain use as a controlled delegation model, not as a one-time configuration task.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: When should organisations tighten DMARC enforcement instead of staying in monitor mode?
A: Once SPF and DKIM are stable and the authorised sending estate is understood. Monitor mode is useful for discovery, but it does not stop impersonation. Enforcement becomes the point where policy starts shaping receiver behaviour and reducing spoofing exposure across the domain.
👉 Read our full editorial: Third-party mail senders need aligned identity, not just SPF passes
This post was modified 7 days ago by NHI Mgmt Group