Messaging Gateway

We wish to have all mail sent for our domain DKIM signed.  We have a marketing vendor who sends on our behalf who is unable to implement DKIM.
What is the best way to use our SMG to relay mail sent from them.  e.g. They send to our SMG, which then does final delivery.

The most obvious (but not secure) would be to expose our outbound interface to the vendor and add their IP address under outbound mail acceptance.

Is there a way to do this (MTA to MTA) using SMTP Auth? 

Other suggestions?

If they are going to be using SMTP Authentication, they can just use the Inbound interface people use to send you incoming mail.

Yes, when you edit a scanner there is a third tab for Authentication. You set it up in your Directory Data source as SMTP Auth. Once you have it working the sending MTA would just need to provide the proper credentials and we'll let them relay. This is mostly used for clients at home to relay through the SMG but it could be useful for what you are describing.

The SMG does not currently have an option to authenticate outgoing emails with another MTA.

Thanks, I've not done SMTPAuth, but I"m familar with that as a Client/MTA practice, not an MTA to MTA setup.  How would that work?

Can SMG send to an MTA that requires SMTP Auth?