How do third-party senders affect alignment?

By default third parties break alignment when they use their own Return Path or DKIM domain. To fix this vendors must support custom DKIM alignment where they provide CNAME records so they can sign with your domain in the d= tag or custom Return Path for SPF alignment. Custom DKIM alignment is the flexible industry standard. The message may pass authentication but fail DMARC.