Xero, Sage, Mailchimp and the Other Services That Send as You

Any service that puts your domain in the From address is sending as you, and each one must pass DMARC through an aligned DKIM signature or an aligned SPF return-path before you move to p=quarantine or p=reject. For most South African businesses that means accounting, CRM, newsletter, e-commerce, booking, payroll and website form systems, not just Microsoft 365 or Google Workspace.

The senders nobody remembers setting up

Ask a business owner how their company sends email and the answer is usually one word: Outlook, or Gmail. Ask the finance manager and you will hear about the accounting package that emails invoices and statements. Ask the marketing person and a newsletter platform appears. Ask reception and there is a booking system sending confirmations. Ask whoever built the website and the contact form turns out to send notifications through its own mail route. Nobody has the whole picture, and that is exactly why so many DMARC projects either stall at p=none or break something important when they enforce.

Many South African SMEs have half a dozen or more distinct systems that send mail with the company domain in the From address. The usual categories are:

• Accounting and invoicing: Xero, Sage and similar packages emailing invoices, quotes, statements and remittances.
• Payroll and HR: payslips and leave notifications, often from a separate payroll product.
• CRM and helpdesk: sales sequences, ticket replies and automated follow-ups.
• Newsletter and marketing: Mailchimp, Brevo and other bulk platforms.
• E-commerce: order confirmations, shipping notices and password resets from WooCommerce or a hosted store.
• Booking and scheduling: appointment confirmations and reminders.
• Website contact forms: WordPress or other CMS notifications, sometimes sent directly from the hosting server.
• Devices and line-of-business systems: multifunction printers and scanners, ERP systems, alarm panels and monitoring tools that relay mail through an SMTP account.

These are not edge cases. Invoices and statements are among the most financially important messages a business sends, and they are frequently the ones that fail authentication because they were configured years ago by someone who has since moved on.

How third-party senders pass DMARC

DMARC passes when either SPF or DKIM passes and the domain that passed aligns with the domain in the visible From header. That second condition is where third-party services trip up. Most platforms send from their own infrastructure, so out of the box they authenticate their own domain, not yours. The message passes SPF and DKIM for the vendor and still fails DMARC for you. We cover the mechanics in depth in DMARC alignment explained; here is how it plays out with external services.

Custom DKIM (the preferred route)

Most reputable platforms let you verify your domain and publish DKIM records, usually one or more CNAME or TXT records under _domainkey.yourcompany.co.za. Once active, the platform signs with d=yourcompany.co.za, which aligns with your From address. DKIM survives most forwarding, and it does not consume SPF lookups, so it is the method to prefer wherever the vendor offers it.

Custom return-path (SPF alignment)

Some platforms let you set a custom bounce or return-path domain, typically a subdomain such as bounce.yourcompany.co.za pointed at the vendor by CNAME. SPF is then evaluated against your subdomain, and under relaxed alignment that aligns with yourcompany.co.za. Without a custom return-path, adding the vendor’s include to your SPF record does nothing for DMARC alignment because SPF is checked against the vendor’s own bounce domain.

Sending from a subdomain

For bulk or marketing mail, many organisations move the sender to a subdomain such as news.yourcompany.co.za. This isolates reputation, keeps your main SPF record lean and lets you manage the subdomain’s authentication separately. The subdomains and the sp= tag article covers how policy applies there.

Relaying through your main mailbox platform

Some systems, especially printers, scanners and older line-of-business software, cannot do custom DKIM at all. The cleanest fix is often to relay them through an authenticated SMTP connector on Microsoft 365 or Google Workspace, so the mail is signed by your main platform and leaves through infrastructure that already aligns.

Finding every sender before you enforce

An inventory built from memory will always be incomplete. The reliable approach combines three sources.

1. Aggregate reports. Publish a DMARC record at p=none with a rua address and collect reports across at least one full business cycle, which for most businesses means a month-end and ideally a quarter-end. Monthly statements, payroll runs and annual renewals only show up when they run. Reading these reports is covered in how to read a DMARC report.
2. Your existing DNS. Your SPF record and any _domainkey records are a partial history of who someone once authorised. Each entry is a lead to verify, and some will be services you stopped using years ago.
3. People and invoices. Ask each department what sends mail on its behalf, and check the supplier list in your accounting system for SaaS subscriptions. A subscription you pay for monthly is a strong hint that something is sending.

Cross-reference the three. A source that appears in reports but in nobody’s memory needs investigating: it is either a forgotten legitimate system or someone spoofing you. A service in SPF that never appears in reports is probably dead and can be removed, freeing a lookup.

Questions to ask every vendor

When a sender is failing alignment, the fix sits in the vendor’s settings, not only in your DNS. These questions get to the answer quickly, and they are worth asking before you sign up for any new platform that will email your customers:

• Can we verify our own domain so that you sign with DKIM as d=yourcompany.co.za?
• What key length do you use, and do you support key rotation?
• Can we set a custom return-path or bounce domain on our domain?
• Which IP ranges or SPF include should we publish, and how many DNS lookups does that include consume?
• Can we send from a subdomain instead of the main domain?
• If custom authentication is not supported, can we relay through our own SMTP server or connector instead?
• Do you send any mail as us that we might not expect, such as system notifications or password resets?

A vendor that cannot answer the first question in 2026 is a vendor whose mail will be at risk once you enforce DMARC, and it is also a vendor whose mail already faces stricter handling at Gmail, Yahoo and Outlook.com under the bulk sender rules described in the Google, Yahoo and Microsoft requirements.

An inventory template you can use

Keep a single sender inventory per domain and treat it as a living document. The columns that matter:

The “business owner” column is the one most often left blank and the one that saves the most time. When a new failing source appears after you reach p=reject, you need a person to ask, not just an IP address.

Common traps with third-party senders

The website contact form

Many WordPress websites send form notifications using PHP mail directly from the web server, with the From address set to the business domain. That mail has no aligned DKIM and usually fails SPF. The fix is an SMTP plugin that sends through an authenticated mailbox or a transactional mail service with your domain verified. Set the From address to your domain and put the visitor’s address in Reply-To, never in From.

Old DKIM records left behind

Clean-up projects sometimes delete _domainkey records that look unfamiliar. Before removing any selector, confirm it does not appear in recent aggregate reports.

SPF bloat

Every platform’s onboarding guide asks you to add its include. Follow them all and you exceed the 10 DNS lookup limit, at which point SPF returns a permanent error for everyone. Prefer DKIM, prune dead includes and see fixing the 10-lookup limit.

Vendors that send as your customers

Some platforms send on behalf of many tenants and default to a shared domain. That is fine as long as the From address is theirs, not yours. Problems start when someone types your domain into a “From” field the platform cannot authenticate.

How MailMarq helps

Building and maintaining the sender inventory is the bulk of the work in any DMARC project, and it is the part MailMarq does for you. During the Observe and Remediate stages we identify every source in your reports, work out how each one should align, give you or your vendors the exact records and settings, and keep watching for new senders all year once you are enforcing. You can start with a free check of your domain or talk to us about your senders.

Frequently asked questions

MailMarq
MailMarq is a managed DMARC service run from Johannesburg. Our team has built and managed business websites, hosting and email infrastructure for South African companies since 2016, and writes these guides from work on real domains.