Separate envelope-from and reply-to email addresses to avoid DMARC failure

My line of thought is that the correct answer to your problem, as expressed so far, is to setup DKIM. Making the mail configuration even more complicated and prone to error is not warranted by your use case, IMO.