r/mimecast

I've inherited a mimecast setup which hasn't been paid much attention to. We have a reasonable number of domains associated (> 20) due to acquisition.

An account review flagged up that the anti-spoofing policies for those domains weren't turned on.

We're now slowly turning them on one by one and have found valid outside senders are getting blocked.

The emails are valid - the SPF records are valid and DKIM is all setup - it all passes when we check manually. Mimecast don't seem to be checking this though and just block it because it's not come from the internal source.

To get around it - we created an SPF bypass for each domain to force mimecast to check the domain's SPF record for validity on arrival.

Mimecast's advice is to setup an SPF bypass which says "everyone to everyone - apply to all emails on all SPF records on all valid domains" (because only one rule can apply on any one transit)

But that means if service A is valid for domain Z, it'll also be valid for domain Y.

This doesn't feel logically sensible - why are we going through all this effort to setup SPF/DKIM for these external senders only to set up a bypass on them?

I think they mean it's completely down.

It's super annoying that in the year of our Lord 2026, the only 2FA they offer is SMS. SMS is the bottom of the barrel when it comes to all the available 2FA methods. C'mon Mimecast!

United States Grid, United States B Grid, United Kingdom Grid, South African Grid, Australian Grid, German Grid, Canadian Grid, Offshore Grid

Anyone else seeing the admin console be unresponsive / not available?

Was in there earlier but starting around 0930 EDT it's been very slow or just not working at all. Cleared cookies, tried a different browser, still can't get in or on the one occasion it did get to a page I needed it then errored and said it wasn't available.