Not always easy to fix the human side.
How could they not have access to a service that they pay for?
It sounds like you have a human problem on your hands, not a technical one. I would think about how to get an updated SPF into their DNS. If the boss said "just make it work" then to me that means to call the clients and hand hold them through figuring out who hosts their DNS records and how to open a support ticket or reset their self-service web portal login password, or whatever else the client needs to do to get those records in there.
SPF is very easy to configure and will improve your deliverability significantly. After you configure SPF, mail servers will acknowledge your servers as a valid sender for your client domain. It will no longer be spoofing. The only difference between spoofing and not spoofing is domain validation.
DKIM is not tied to an IP address but the 2 extra steps of complexity involved with DKIM have allowed for SPF to be the dominant domain verification method for sending email.
Exactly my point
Generally, they are on autopay and haven't had to sign in for several years. We often run into an issue where the person who set it up is no longer with the company and they no longer have the associated email address set up, so they can't do a password reset (without setting up the email, at least, which means hunting down how to do that; we're talking <5 person companies that haven't had a new employee in years)
> It sounds like you have a human problem on your hands, not a technical one.
This is definitely the problem. :/
The world changes, and adaptation requires maintenance. 10 years ago is almost half the age of the web ago. This is more a business decision - do you let those accounts rot - than it is a technical decision. Because the business decision needs to include support time for user interaction.