DMARC report from mimecast.org: what it means
Getting a DMARC aggregate report from mimecast.org when you have no relationship with Mimecast is normal, and the explanation is the same one that covers most confusing report senders: the reporting organisation is whoever received mail claiming to be from your domain. Mimecast is an email security gateway, so it receives mail on behalf of the organisations sitting behind it.
Why a security gateway is reporting on your domain
Companies that use a gateway point their MX records at the gateway rather than directly at their mailbox provider. Everything addressed to those companies arrives at the gateway first, gets filtered, and is then passed on. Which means the gateway — not the company's mail host — is the party evaluating your DMARC record and tallying the results.
So a Mimecast report means: somebody protected by Mimecast received messages with your domain in the From address. That could be your customer, your supplier, a prospect, or the target of someone impersonating you. You need no contract with Mimecast for this to happen, and there's nothing to opt out of.
The same reasoning covers reports from other gateways, universities, hosting companies and appliance vendors. It's also exactly why enterprise.protection.outlook.com shows up for domains that don't use Microsoft.
Is it legitimate?
Check it rather than take the name on trust:
- Confirm your domain publishes a
rua=address pointing at this mailbox — the free DMARC checker reads the live record. - Confirm the attachment is a real aggregate report by opening it in the free DMARC report analyzer, which parses it in your browser and uploads nothing.
The filename follows the fixed convention — reporting organisation, your domain, then the window's start and end as Unix timestamps — and the message itself asks nothing of you. Any DMARC-themed mail with a link to click or a login to complete is something else entirely.
Why gateway reports are disproportionately interesting
Volume is low: a gateway reports only on the organisations it protects. But the composition of that volume is unusual, and it makes these reports worth more than their size suggests.
Gateways sit in front of businesses that bought security software. They are, by selection, organisations with something to protect — and they are the natural target for invoice fraud and supplier impersonation. Mail forged in your name to one of your business customers is precisely the attack DMARC exists to stop, and this is the report where you'd see it.
Gateways also forward. A message that passes through a gateway on its way to a mailbox has been relayed, which breaks SPF while leaving DKIM intact. Expect to see SPF failures with DKIM passing here more often than in reports from mailbox providers — that pattern is usually forwarding, not an attack. Why SPF and DKIM show fail covers telling them apart, and it's the strongest practical argument for making sure DKIM is signing your mail: it survives the hop where SPF doesn't.
Reading it
Standard aggregate format: who reported and for which UTC day, the DMARC record they resolved for your domain, then one block per source IP with a count, aligned SPF and DKIM verdicts, and the disposition applied. DMARC aggregate reports explained covers each field; source IPs in DMARC reports covers judging an address you don't recognise.
Focus on the rows where both SPF and DKIM fail and the IP is unfamiliar. That combination, arriving at a business protected by a security gateway, is the highest-signal thing in any DMARC report you'll receive.
What to do next
If your own senders are failing alignment, fix those before tightening your policy. If unknown senders are the story, that's the case for moving off p=none — see DMARC policies explained for the staged walk to enforcement.
Either way, don't stop the reports by removing the DMARC record: you'd keep the exposure and lose the only measurement of it. Point rua= at a monitor that reads every report, resolves each IP to a named sender, and alerts you when something changes. Canny Pigeons does that free for one domain, hosted DMARC included.
Free checks: Report analyzer DMARC checker SPF checker DKIM checker
Reports from other submitters too? Why am I getting DMARC report emails? covers the whole set.