Applies To...

This page applies to new clients connecting with Mimecast using the Connect Application. If you are not using the Connect Application, click here.

Overview

Sender Policy Framework (SPF) is an open standard for email authentication. It validates the connecting IP address, by looking up the SPF / TXT record in DNS for the domain in the envelope MAIL FROM or HELO/EHLO. By adding our _netblocks.mimecast.com entry to your SPF / TXT record, you ensure we are allowed to send mail for your domain name. Mail Transfer Agents (MTAs) can verify SPF for inbound emails if the sender publishes DNS entries for them in their domain records.

Implementing SPF for Outbound Email Delivery

To ensure a successful implementation of SPF with Mimecast, include a comprehensive list of our outbound IP addresses in your DNS SPF record. This is a long list (24 distinct IP4 ranges at the time of writing) and new ranges may be added in the future without notice. However, you can ensure your record is always up to date by including the "xx._netblocks.mimecast.com" statement.

To determine what "xx" is for your region, refer to the table below:

Some typical examples are suggested below as a starting point for constructing an appropriate record:

Creating the DNS Entry

If you wish to implement SPF for your domain, you'll need to create a corresponding TXT DNS record. By adding our IP Ranges to your TXT / SPF record, you ensure Mimecast is allowed to send mail carrying your domain name.

To create a DNS record:

1. Update the SPF records for your domains with the information displayed in the application under SPF Record, as shown below:
   
   
   Only use the SPF record displayed in the application, as there are regional differences (i.e. "eu" for Europe in the above image). The regional records are also listed in the "Implementing SPF for Outbound Email Delivery" section above. If you're not the person responsible for this task, click the Share link to send an email containing the required detail to someone who is
   1. Log on to your Domain Registrar.
   2. Update / replace each domain’s SPF record to specify us as the authorized outbound service.
   3. If all email for your domains will be routed via us, remove all previous SPF records.
   4. Other outbound sources for your domain may require a combined SPF record. In this instance, ensure you include the Mimecast "xx_netblocks.mimecast.com" entry before creating a mail flow connector. To determine what "xx" is, refer to step 1 above.
      
      See the "Implementing SPF for Outbound Email Delivery" section in the Configuring DNS Authentication Definitions and Policies page, and the Implementing SPF for Outbound Email Delivery page for additional information.
2. Optionally test your SPF record:
   
   1. Navigate to Platform | Set Up Your Outbound Email in the Connect Application.
   2. Select your domain from the Record to Validate drop down menu.
   3. Click on the Validate button. One of the following messages will display:
      
      • A green tick confirms the SPF record is valid.
      • A red exclamation confirms the SPF record is invalid.
   4.  Click on the More or Less links to view further information about the SPF record and toggle the display.
      
      This step performs a TXT record lookup and validates the SPF record entry. You can have more than one mechanism (IP/Host), but Mimecast must be the first one listed.