Is DMARC relaxed alignment for SPF/DKIM bad?

Question

After studying authentication mechanisms available to prevent e-mail spoofing, still I don't understand how to choose between the relaxed alignment and the strict alignment in DMARC for SPF and DKIM, apart from parent/child domain considerations. I did not find useful information in RFC 7489 on an eventual weakness of the relaxed alignment. Though I understand perfectly how these 2 alignments work, my questions are:

1. Is it bad to use a relaxed alignment compared to the strict alignment?
2. Are there any weaknesses when using the relaxed alignment with SPF, DKIM, or both?

Answer 1

Relaxed Alignment let's you authenticate your FROM domain by using a subdomain in your DKIM signature (d=sub.domain.tld) or Return-Path address ([email protected]). This is very useful for delegating subdomains to third parties to authenticate on your behalf. There are many reasons one might choose to: bounce-handling capabilities of the 3rd party, or; the organizational domain's SPF record exceeding the DNS Lookup limit (max 10 lookups allowed during SPF check), and more.

The consequence is that any of those parties allowed to authenticate on behalf of the subdomain can send from the organizational domain in the FROM address, if the DMARC alignment policies are set to relaxed, which is the default. Also, those 3rd parties will be able to use other subdomains, existing or non-existing, in the FROM address as well, if there is not a DMARC record published for the subdomain. Because, the check will fall back to the organizational domain's DMARC record if none is present at the subdomain used in the FROM field.

I'm not entirely sure if this constitutes a weakness.