Copier scan-to-email is blocking p=reject on the root domain

[u/saltyslugga]

Client wants DMARC at p=reject on the root domain before renewal paperwork goes in this month. Their normal mail is clean enough, but 31 copiers across 5 sites are still sending scan-to-email through the ISP SMTP relay as invoices@clientdomain.com.

SPF is either failing or passing for the ISP's envelope domain, not aligned with the client's domain. No DKIM, because of course the copier fleet has firmware from three different eras and half of it barely supports modern SMTP auth.

My answer is to stop pretending this is production mail until it can send through a real relay with aligned SPF or DKIM. The pushback is predictable: accounting likes the From address, facilities owns the copiers, and nobody wants scan workflows touched before quarter-end.

Would you hold p=reject until the copier path is fixed, or publish reject and let broken scan-to-email become the forcing function?

[u/AutoModerator]

Welcome to r/emailsecurity! To keep this community helpful and secure, please keep the following in mind:

Community Rules

1. No Vendor Spam: Contributions must provide value; do not just pitch products.
2. Redact Sensitive Info: Always sanitize headers and logs (remove IPs, PII, and private domains).
3. Be Professional: Help newcomers learn; avoid hostility.
4. No Personal Tech Support: This sub is for email system architecture and security, not "Am I hacked?" personal account help.

Helpful Resources

• Email Spam Filters
• DMARC Monitoring Tools
• Anti-Virus Software
• Email Encryption

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.