Mimecast Email Security Setup Guide India — MX Records, SPF, DKIM & Microsoft 365

Mimecast Email Security deploys as a cloud MX gateway between the internet and your email platform. All inbound email passes through Mimecast's infrastructure for scanning before delivery to Microsoft 365 or Exchange. This guide covers the complete setup process for Indian organisations — MX record changes, SPF updates, Microsoft 365 connector configuration, DKIM, and DMARC policy setup.

Prerequisites Before You Start

Mimecast account provisioned — your Mimecast subscription must be activated and your domain added to the Mimecast Administration Console
DNS access — admin access to your domain registrar (GoDaddy, BigRock, Namecheap, or hosting provider DNS)
Microsoft 365 Global Admin (or Exchange Admin) access
Current MX records noted — document existing MX records before making any changes
SPF record backed up — copy your current SPF TXT record

Step 1 — Add and Verify Your Domain in Mimecast

Log in to Mimecast Administration Console (login.mimecast.com)
Navigate to Administration → Gateway → Domains
Click New Domain, enter your domain name
Mimecast provides a TXT verification record:

Type: TXT
Name: _mimecast.yourdomain.com  (or @ for root verification — check your Mimecast instruction)
Value: MmcvSxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
TTL: 3600

Add this TXT record in your DNS panel. Mimecast verification typically completes within 15–60 minutes after DNS propagation.

Step 2 — Change Your MX Records

This is the primary change that routes inbound email through Mimecast.

Mimecast MX records (standard for India):

Type: MX  Priority: 10  Value: eu-smtp-inbound-1.mimecast.com
Type: MX  Priority: 20  Value: eu-smtp-inbound-2.mimecast.com

Note: Mimecast provides region-specific MX hostnames. Your Mimecast onboarding documentation confirms the exact hostnames for your account (EU, US, ZA, or DE cluster). Use the hostnames from your Mimecast console, not generic examples.

Recommended transition approach (reduces mail flow disruption):

Phase 1 — Add Mimecast at higher priority:
  Priority 10:  eu-smtp-inbound-1.mimecast.com   (Mimecast — new)
  Priority 20:  eu-smtp-inbound-2.mimecast.com   (Mimecast — new)
  Priority 100: yourdomain-com.mail.protection.outlook.com  (M365 — temporary fallback)

Phase 2 — After 24–48 hours, remove old MX:
  Priority 10:  eu-smtp-inbound-1.mimecast.com
  Priority 20:  eu-smtp-inbound-2.mimecast.com

DNS propagation takes 24–48 hours globally. During this window, some senders will reach Mimecast first and some will still reach Microsoft 365 directly. Mimecast should begin receiving mail within 2–4 hours of the MX change.

Step 3 — Configure the Delivery Route (Microsoft 365)

Tell Mimecast where to deliver clean mail after scanning.

In Mimecast Administration Console → Administration → Gateway → Policies → Definitions → Email Routing
Configure your Inbound Route (also called Delivery Route):
- For Microsoft 365: yourdomain-com.mail.protection.outlook.com on port 25
- For on-premise Exchange: your Exchange server's public IP or hostname
Enable Force TLS for the delivery connection

Step 4 — Lock Down Microsoft 365 to Accept Only Mimecast IPs

After Mimecast is routing your mail, you must prevent email bypassing the gateway by arriving directly at Microsoft 365.

Create a Connector in Exchange Admin Center

Go to Exchange Admin Center (admin.exchange.microsoft.com) → Mail Flow → Connectors
Click + Add a connector
Connection type: Partner organisation → Office 365
Configure:
- Name: Mimecast Inbound
- Sender: IP addresses — add Mimecast's egress IP ranges
- Action: Reject email that does not match these IPs

Mimecast egress IP ranges (get the current list from your Mimecast console): Navigate to Mimecast Administration Console → Support → Useful IP Ranges for the authoritative current list. These change periodically; always use the console values rather than hardcoded lists.

Set connector to apply to All accepted domains

Without this step, a sender who looks up your old Microsoft 365 MX record can bypass Mimecast entirely. This connector closes that bypass.

Step 5 — Update Your SPF Record

SPF (Sender Policy Framework) defines which IP addresses are authorised to send email on behalf of your domain. If you route outbound mail through Mimecast, you must add Mimecast's sending IPs to your SPF record.

Current SPF (Microsoft 365 only):

v=spf1 include:spf.protection.outlook.com -all

Updated SPF (Microsoft 365 + Mimecast outbound):

v=spf1 include:spf.protection.outlook.com include:_netblocks.mimecast.com ~all

SPF lookup limit: SPF records are limited to 10 DNS lookups per evaluation. If your current SPF record already has multiple includes, verify the total count after adding Mimecast. Use MXToolbox SPF Checker to validate.

If you are not routing outbound mail through Mimecast (Mimecast inbound only), you do not need to add Mimecast to your SPF record.

Step 6 — DKIM Configuration

Your Domain's DKIM Keys

Both Microsoft 365 and Mimecast can sign outbound mail with your domain's DKIM key. Configure Microsoft 365 DKIM first:

In Exchange Admin Center → Email Authentication → DKIM
Select your domain and enable DKIM signing
Add the CNAME records Microsoft provides to your DNS:

Type: CNAME
Name: selector1._domainkey.yourdomain.com
Value: selector1-yourdomain-com._domainkey.youronmicrosoft365tenant.onmicrosoft.com

Type: CNAME
Name: selector2._domainkey.yourdomain.com
Value: selector2-yourdomain-com._domainkey.youronmicrosoft365tenant.onmicrosoft.com

Mimecast DKIM Signing (if routing outbound through Mimecast)

If Mimecast is your outbound mail gateway (not just inbound), configure Mimecast DKIM signing:

Mimecast Administration Console → Administration → Gateway → Policies → Definitions → DNS Authentication — Outbound
Mimecast generates a DKIM key pair and provides CNAME records to add to your DNS
After DNS propagation, Mimecast signs outbound mail with your domain's DKIM key

Avoid having both M365 and Mimecast signing with the same DKIM key selector — use the Microsoft selectors for M365-sent mail and Mimecast selectors for Mimecast-routed mail.

Step 7 — DMARC Policy Setup

DMARC (Domain-based Message Authentication, Reporting and Conformance) instructs receiving mail servers what to do with messages that fail SPF and DKIM checks, and sends aggregate reports showing all senders using your domain.

DMARC DNS record:

Type: TXT
Name: _dmarc.yourdomain.com
Value: v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com; pct=100; adkim=r; aspf=r

Policy progression:

Start with p=none during Mimecast deployment — monitoring only, no mail is affected
Review DMARC aggregate reports for 2–4 weeks to identify all legitimate mail sources
Move to p=quarantine once all legitimate senders pass SPF or DKIM alignment
Move to p=reject for maximum enforcement

Mimecast includes a DMARC Analyser tool in its Advanced DNS Authentication suite — this provides aggregate report parsing, sender visualisation, and guided policy progression.

Step 8 — Configure Mimecast Inbound Policies

After mail flow is confirmed through Mimecast, configure your protection policies in the Administration Console.

Anti-Spam Policy

Spam Detection Level: Aggressive (recommended for most Indian businesses)
Action on High-Confidence Spam: Hold (quarantine) — users receive a quarantine digest
Quarantine Digest: Daily, allowing self-release for false positives
Graymail: Separate policy for newsletters/bulk commercial email — route to a separate folder or tag subject

Anti-Malware Policy

Action on detected malware: Remove attachment, deliver clean message with notification
Sandbox analysis (Targeted Threat Protection): Enable for all attachment types

URL Protection (Targeted Threat Protection)

URL Rewriting: All URLs in inbound email are rewritten to pass through Mimecast's click-time scanner
On-click scanning: If a URL becomes malicious after email delivery, Mimecast blocks it at click time
Action on malicious URL: Block — redirect to Mimecast's block page

Attachment Protection (Targeted Threat Protection)

Safe Document Conversion: Office documents converted to safe PDF for viewing before the original is released
Sandbox Analysis: Suspicious attachments submitted to Mimecast's sandbox
Action on malicious attachment: Hold for admin review

Impersonation Protection (Anti-BEC)

Protected Display Names: Add your C-suite (CEO, CFO, Directors, Finance team) by name
Action: Hold for admin review and notify the recipient
Lookalike Domain Detection: Enable to catch typosquatted sender domains (c1oudfy.com instead of cloudfy.com)

Step 9 — Post-Deployment Verification

After completing all steps, verify the setup:

Send a test email from an external address. Check the headers for X-MC-* Mimecast processing headers.
Check SPF: Use Google Admin Toolbox → CheckMX or MXToolbox
Check DKIM: Send a test to check-auth@verifier.port25.com — you'll receive an authentication report by email
Check DMARC: Use MXToolbox DMARC Lookup on your domain
Verify M365 bypass is blocked: Use MXToolbox MX Lookup to confirm only Mimecast IPs resolve for your domain. Attempt a direct SMTP connection to your M365 MX — it should reject mail not from Mimecast IPs.

Common Issues

Mail not flowing through Mimecast after MX change: Wait for DNS propagation (up to 48 hours). Check propagation status with nslookup -type=MX yourdomain.com from multiple locations.

Legitimate mail going to quarantine: Add the sender domain or IP to your Mimecast Permit List (Administration → Threat Intelligence → Permit and Block Lists).

SPF failure on outbound mail after adding Mimecast: Verify include:_netblocks.mimecast.com is in your SPF record and the total DNS lookup count does not exceed 10.

Users not receiving quarantine digest: Check that the user's email address is correctly populated in Mimecast's directory. Mimecast pulls user lists from your Microsoft 365 directory via Azure AD sync — ensure directory sync is configured.

Cloudfy Systems is an authorised Mimecast partner in India. We handle complete Mimecast deployments — MX record changes, SPF/DKIM/DMARC setup, Microsoft 365 connector configuration, policy setup, and post-deployment verification. Contact us for a same-day INR deployment quote.