Customers currently using the Connect Application are advised to complete their onboarding setup as soon as possible, as the Connect Application is scheduled to be discontinued on the 31st of January, 2024.
This guide explains how new clients connecting with Mimecast can implement SPF for outbound email delivery using the Mimecast Connect Application, including steps to configure DNS records, ensure proper authentication, and validate SPF records for secure email communication. If you are not using the Connect Application, see Connect Process - Steps.
Also see Configuring DMARC.
Introduction
Sender Policy Framework (SPF) is an open standard for email authentication. It validates the connecting IP address, by looking up the SPF / TXT record in DNS for the domain in the envelope MAIL FROM or HELO/ EHLO.
By adding our _netblocks.mimecast.com entry to your SPF / TXT record, you ensure we are allowed to send mail for your domain name. Mail Transfer Agents (MTAs) can verify SPF for inbound emails if the sender publishes DNS entries for them in their domain records.
Implementing SPF for Outbound Email Delivery
To ensure a successful implementation of SPF with Mimecast, include a comprehensive list of our outbound IP addresses in your DNS SPF record. This is a long list (24 distinct IP4 ranges at the time of writing) and new ranges may be added in the future without notice. However, you can ensure your record is always up to date by including the "xx._netblocks.mimecast.com" statement.
To determine what "xx" is for your region, refer to the table below:
| Region | Record |
|---|---|
| Europe (Excluding Germany) | v=spf1 include:eu._netblocks.mimecast.com ~all |
| Germany | v=spf1 include:de._netblocks.mimecast.com ~all |
| United States of America | v=spf1 include:us._netblocks.mimecast.com ~all |
| United States of America (USB) | v=spf1 include:usb._netblocks.mimecast.com ~all |
| USPCOM | v=spf1 include:uspcom._netblocks.mimecast-pscom-us.com ~all |
| Canada | v=spf1 include:ca._netblocks.mimecast.com ~all |
| South Africa | v=spf1 include:za._netblocks.mimecast.com ~all |
| Australia | v=spf1 include:au._netblocks.mimecast.com ~all |
| Global (includes all the above) | v=spf1 include:_netblocks.mimecast.com ~all |
Mimecast uses the below IP Blocks for delivery of messages in certain use cases, for example, where the sender domain does not match an internally registered domain (impersonation). The Global SPF Record Block includes all regions. However, it does not include USB IP addresses.
If you wish to impersonate a domain you do not own, for example with address rewriting, use the DNS Authorization Code found in Account Settings.
The Mimecast Secure Email Gateway checks messages that are sent from each account. If the sending domain doesn't match a domain listed as internal to the account, it will then check the TXT record of the sending domain for the presence of the DNS Authorization Code. If this code isn't present, messages will be sent using these IP blocks instead of the normal route.
| Region | Netblocks |
|---|---|
| Europe (Excluding Germany) | eu._extnetblocks.mimecast.com |
| Germany | de._extnetblocks.mimecast.com |
| United States of America | us._extnetblocks.mimecast.com |
| United States of America (USB) | usb._netblocks.mimecast.com |
| USPCOM | uspcom._netblocks.mimecast-pscom-us.com |
| Canada | ca._extnetblocks.mimecast.com |
| South Africa | za._extnetblocks.mimecast.com |
| Australia | au._extnetblocks.mimecast.com |
Some typical examples are suggested below as a starting point for constructing an appropriate record.
The examples state that an "MX" mechanism can continue to be in the SPF record in addition to Mimecast include. Where customers who've their MX records pointing to Mimecast servers (e.g. 2 mail servers- us-smtp-inbound-1.mimecast.com and us-smtp-inbound-2.mimecast.com) have each server pointing to 16 A records which:
- Exceeds the allowed lookup limit for address records.
- Results in an error during SPF validation.
If you update your MX records to point to Mimecast servers, remove the "MX" mechanism from the SPF record and only include "xx._netblocks.mimecast.com" to permit Mimecast as a legitimate sender.
|
Simple Case |
Relaxed configuration for customers which only send external mail for a given domain via Mimecast. |
"v=spf1 include:_netblocks.mimecast.com ~all" |
||||||||
|
Strict Case |
For customers wishing to implement a strict SPF reject for unmatched requests, we strongly recommend testing with the relaxed syntax first. |
"v=spf1 include:_netblocks.mimecast.com –all" |
||||||||
|
Customers with an Existing SPF Record for a Given Domain |
If you have an existing SPF record representing a range of possible senders, these examples show how you can include Mimecast as a legitimate sender. |
|
||||||||
|
Customers with an Existing SPF Include Record for a Given Domain |
In all cases, customers with existing SPF records should review their entries to ensure Mimecast servers are referenced exactly once. Any previous Mimecast references should be removed in favor of _netblocks.mimecast.com. Customers using a domain include a mechanism to refer to a DNS entry which already references _netblocks.mimecast.com, need take no further action. |
|
See Connect Application - Setting Up Your Outbound Email for more information on updating your SPF records via the application.
Creating the DNS Entry
If you wish to implement SPF for your domain, you'll need to create a corresponding TXT DNS record. By adding our IP Ranges to your TXT / SPF record, you ensure Mimecast is allowed to send mail carrying your domain name.
You can create a DNS record, by using the following steps:
- Update the SPF records for your domains with the information displayed in the application under SPF Record, as shown below:
Only use the SPF record displayed in the application, as there are regional differences (i.e. "eu" for Europe in the above image). The regional records are also listed in the "Implementing SPF for Outbound Email Delivery" section above. If you're not the person responsible for this task, click the Share link to send an email containing the required detail to someone who is.
- Log on to your Domain Registrar.
- Update / replace each domain's SPF record to specify us as the authorized outbound service.
- If all email for your domains will be routed via us, remove all previous SPF records.
- Other outbound sources for your domain may require a combined SPF record. In this instance, ensure you include the Mimecast "xx_netblocks.mimecast.com" entry before creating a mail flow connector. To determine what "xx" is, refer to step 1 above.
See the "Implementing SPF for Outbound Email Delivery" section in the Configuring DNS Authentication Definition page and Implementing SPF for Outbound Email Delivery for additional information.
- Optionally test your SPF record:
- Navigate to Platform | Set Up Your Outbound Email in the Connect Application.
- Select your domain from the Record to Validate drop-down menu.
- Click on Validate. One of the following messages will display:
-
- A green tick confirms the SPF record is valid.
- A red exclamation mark confirms the SPF record is invalid
- Click on More or Less to view further information about the SPF record and toggle the display.
This step performs a TXT record lookup and validates the SPF record entry. You can have more than one mechanism (IP/Host), but Mimecast must be the first one listed.
Comments
Please sign in to leave a comment.