Email Security Setup Wizard - Configure Mail Routing with Google Workspace

This article contains information on configuring Mimecast and Google Workspace for inbound and outbound mail routing, including delivery routes, inbound gateway trust, host routes, and optional internal routing.

Set Google Workspace as the Mimecast delivery route (Inbound)

In Mimecast’s Mail Flow Configuration, validate Google Workspace as the destination for inbound delivery:

1. In the Mimecast Administration Console, open the Mail Flow Configuration Wizard.

2. For Google Workspace, use Hostname: ASPMX.L.GOOGLE.COM (SMTP port 25).

3. Click Check and proceed when validation succeeds.

If validation fails, confirm firewall access from Mimecast to Google and retry host validation.

Configure Google Workspace Inbound Gateway (trust Mimecast)

This ensures Gmail trusts messages delivered by Mimecast and preserves correct spam/routing behavior.

1. Sign in to Google Admin Console.

2. Go to Apps | Google Workspace | Gmail | Spam, Phishing and Malware.

3. Find the Inbound gateway and click Configure (or Add another rule).

4. Add the Mimecast IP ranges for your region to Gateway IPs, and enable Automatically detect external IP.

5. Optionally require TLS if mandated by policy, then Save.

Key fields

• Gateway IPs: Mimecast regional IP ranges (obtain from Mimecast Administration Console Account Settings or the IP ranges reference page).

• Message tagging: Typically, leave disabled unless your policy requires regex header checks.

• Require TLS: Enable if your compliance standards require TLS from Mimecast to Google.

If the Inbound Gateway is not configured, Gmail may treat Mimecast-delivered mail as external/unknown, causing spam misclassification or rejections.

Configure Outbound routing from Google Workspace to Mimecast

Create a Gmail host route and a routing rule to send outbound mail to Mimecast.

Create Mimecast hosts in Gmail

1. In Google Admin Console, navigate to Apps | Google Workspace | Gmail | Hosts.

2. Click Add Route.

3. Name: Mimecast Outbound Gateway.

4. Specify Email Server: choose Multiple hosts and add the Mimecast smart hosts for your region.

5. Enable Require TLS if required, then Save.

Create a routing rule

1. Go to Apps | Google Workspace | Gmail  Routing.

2. Click Configure / Add another rule.

3. Name: Route Outbound via Mimecast.

4. Email messages to affect: select Outbound.

5. For the above types of messages, do the following: select Change route and choose Mimecast Outbound Gateway.

6. Show options

   • Envelope filter: limit to specific senders or an address list if only certain validated domains should route via Mimecast.

7. Click Save.

If only some domains are validated in Mimecast, scope the rule to those domains using an address list. Ensure your SPF includes Mimecast alongside any other authorized senders.

Configure internal mail routing

Decide whether internal messages between users in the same Google Workspace domain should traverse Mimecast for policy/DLP or stay inside Google.

Route internal via Mimecast

1. Go to Apps | Google Workspace | Gmail | Routing | Configure / Add another rule.

2. Name: Route Internal via Mimecast.

3. Email messages to affect: select Internal - sending.

4. For the above types of messages, do the following: select Change route | Mimecast Outbound Gateway.

5. Save and allow propagation.

Use this option if you require Mimecast policies (DLP/content inspection), journaling/archiving parity, or monitoring on internal mail.

See also

• Email Security Setup Wizard – Onboarding – Mail Flow Configuration