MailFixIt

Mimecast Cloud Gateway setup

Mimecast: SPF fails for outbound mail

The envelope sender's SPF policy may not include the Mimecast region that made the final SMTP connection.

Problem description

The visible symptom is:

Authentication-Results: spf=fail smtp.mailfrom=example.com

Check the sending domain

Fix the SPF failure

  1. Read smtp.mailfrom or Return-Path in the failed message.
  2. Confirm the message was sent through Mimecast and identify the account region.
  3. Copy the current regional SPF include from Mimecast documentation or the setup application.
  4. Add it to the existing v=spf1 TXT policy before the final all mechanism.
  5. Keep one SPF policy and preserve every other active sender.
  6. Send a new message and confirm spf=pass for the expected envelope domain.

Common causes

The wrong regional include was used, the include appears after -all, the record was published at the visible From domain instead of the envelope domain, or two SPF policies exist.

What the check proves

MailFixIt can expose public syntax, duplicates, dependency failures, and unauthorized addresses. It cannot prove that a historical message used Mimecast.

Frequently asked questions

Which Mimecast SPF include should I use?

Use the include shown for your Mimecast region. The global include can cover all regions, but it may authorize more infrastructure than your account needs.

Does a correct DNS record prove the gateway is using it?

No. The gateway must also enable the matching route, signing profile, or policy. Confirm the result in a new message header.

Related email diagnostics

SPF is not configured for the envelope sender domainDiagnose SPF missing on a bounce or MAIL FROM subdomain. Check the exact envelope domain, add only authorized senders, and verify safely. SPF terms after all are ignoredDiagnose SPF includes and redirects placed after all. Find unreachable sender authorization, reorder the policy safely, and verify the result. Mimecast: inbound mail bypasses the gatewayFix inbound mail that bypasses Mimecast or stops after a regional MX record change.

Primary sources: Mimecast: implement SPF for outbound email.