Why is mail held by DMARC policies?

DMARC is an email security protocol that verifies email senders and enables organisations to protect their domains from unauthorized access and usage. This is crucial as email is increasingly vulnerable to cyberattacks, such as phishing, spoofing and impersonation attacks. 

The DMARC record of a sending organisation tell us what to do if we receive an email from their domain that fails DMARC checks, often this will tell us to quarantine (hold) the email. 

Any emails that fail DMARC verification and are held by Mimecast is due to sender not having the correct DMARC records configured by their organisation. 

How do I know if it's held by DMARC policy? 

You will know one of your emails is being held when you receive an email from Postmaster@sussex.ac.uk with the subject 'This message triggered content policies'.  The Policies Triggered will show ‘DNS Authentication: DMARC Fail’ .

How to release mail 

If an email has failed DMARC checks it can only be released by an administrator.  Please log a ticket with the IT Service Desk to ask for the email to be released – include a copy of the Mimecast notification so that we can easily find the relevant email. 

How can I stop mail being held?  

In the first instance you should contact the sender to inform them that their emails are failing DMARC checks and are quarantined by our mail security system. They should liaise with their IT department to arrange future emails are DMARC compliant. Further information can be found here What Is DMARC? | Mimecast

Can I request emails to be allowed through DMARC checks?

If you frequently receive mail from a particular sender that is failing DMARC checks we can consider bypassing the policy if deemed appropriate due to legitimate business need and it would not pose any significant risk to do so.  

Please note, we will also liaise with the sending organisation to advise them of your request, so they can fix the underlying issue.   Please complete the Mimecast Allow Request Form