Introduction
Third-party senders — marketing platforms, CRMs, transactional services, billing systems — are where most DMARC rollouts get stuck. Each one needs to be inventoried, attributed, and authenticated. This article is the playbook.
Why this topic matters
Internal mail is straightforward; third-party senders are the wild west. A typical mid-market domain has 10-20 third-party senders, most of which IT didn't approve and 2-3 of which nobody can identify on first audit.
The categorization framework
Every sender in your aggregate reports falls into one of four categories:
- Known legitimate, fully authenticated. Pass rate ~100%. No action needed.
- Known legitimate, partially authenticated. Passes via SPF or DKIM but not both. Often misaligned. Remediation: enable custom DKIM at the platform.
- Known legitimate, unauthenticated. No SPF inclusion, no DKIM. Remediation: either authenticate, isolate on a subdomain, or stop using the platform.
- Unknown. Could be legitimate (someone added it without telling you) or attacker. Investigate.
Step-by-step approach to inventory
- Pull the last 30 days of aggregate reports. Sender-by-sender breakdown.
- Reverse-DNS each source IP. Map to vendor.
- Check against known SaaS providers. Marketing platforms, CRMs.
- For unknowns, check public threat intelligence and ask the client whether they recognize the sender.
- Categorize.
Common third-party senders to expect
The usual suspects in a mid-market domain:
- Marketing: Mailchimp, HubSpot, Klaviyo, Marketo
- Transactional: SendGrid, Mailgun, Amazon SES, Postmark
- CRM: Salesforce, HubSpot Sales, Outreach
- Support: Zendesk, Intercom, Freshdesk
- Billing: Stripe, QuickBooks, Xero
- HR: BambooHR, Gusto, Workday
- Internal tools: Slack notifications, monitoring services
Each platform has its own custom-DKIM setup flow.
Best practices
- Treat new senders as a compliance event. Marketing adding a tool means a DKIM setup the same day.
- Standardize attribution. Source IP → vendor mapping in your platform.
- Productize the remediation for common platforms. Standard playbooks for Mailchimp, HubSpot, etc.
- Don't accept "we don't know what that is." Investigate every unknown sender.
- Use subdomain isolation for problem senders. Senders that can't authenticate cleanly go on a subdomain.
Recommended next step
For your client base, build a vendor mapping table. As new senders appear in aggregate reports, the table tells you immediately who it is and the standard remediation.
FAQ
How long does third-party sender inventory take?
2-4 hours for a typical mid-market client. Longer if many unknowns.
What if a sender refuses to support custom DKIM?
Subdomain isolation or migrate to a competitor. In 2026, most platforms support it.
How do I handle marketing teams adding tools?
A policy requiring IT review of new sending platforms. Reinforced by DMARC monitoring alerts.
What if the client uses a marketing agency?
The agency's sending IPs need to be in SPF or the agency's platform needs custom DKIM. Treat as a vendor.
Should I block unknown senders aggressively?
During monitoring, no — they might be legitimate. At p=reject, yes — they'll bounce until authenticated.
Final thoughts
Third-party sender management is the recurring operational work of a DMARC engagement. The inventory is finite; the new-sender drift is steady-state.
Build the framework once, productize the playbooks, and the work compresses to a few minutes per new sender.