Configuring Mimecast to allow Chaser payment chases

If your organization uses Mimecast as its email security gateway, chase emails may be blocked, quarantined, or flagged as spoofed after you verify your sending domain. This happens because Mimecast sees a message carrying your own domain in the From address arriving from an external server, which matches the pattern of a spoofing attempt. This article explains why this happens and what to configure in Mimecast to fix it.

What you can do

Create an anti-spoofing bypass policy so chases reach internal recipients
Add impersonation protection exceptions to prevent chases being flagged as suspicious
Test internal chases without them landing in quarantine

Before you start

You'll need admin access to the Mimecast console
Your sending domain should be verified in Chaser before testing. If the Reply-To address looks unrelated to the From address, that's a sign domain verification isn't complete — fix that first, and one of the triggers below disappears without needing a Mimecast exception
Loop in your security team before making changes. These policies narrow your protection against domain spoofing, and sign-off should come from them, not just your mail admin

Why Mimecast blocks chase emails

Chase emails carry your own domain in the From address but arrive from Chaser's sending infrastructure rather than your own mail servers. When the recipient is inside your own organization, Mimecast treats this as an external message claiming an internal identity — which is the definition of a spoofing attempt.

This applies even when SPF, DKIM, and DMARC all pass. Authentication checks and Mimecast's anti-spoofing checks are separate systems. Passing one doesn't satisfy the other.

Anti-spoofing bypass policy

This is the main fix. Mimecast's anti-spoofing policy rejects messages at the gateway when the Header From or Envelope From carries an internal domain but the sending IP doesn't match an approved source. The ordinary Permitted Senders list won't override this. Anti-spoofing policies take precedence over it, so you need a dedicated bypass policy.

To create the bypass policy:

Go to Gateway, then Policies, then Gateway Policies
Create a new Anti-Spoofing policy
Set Action to Take No Action
Set Addresses Based On to Both
Scope the policy to Chaser's sending source

For scoping, you have two options. You can use an IP range in CIDR notation, or use an SPF-based bypass that checks the sender against Chaser's published SPF record. The SPF-based approach holds up better if sending infrastructure changes over time. Use IP pinning only if there's a specific reason to.

Impersonation protection exceptions

Three specific impersonation checks can trigger independently of the anti-spoofing policy. Each needs its own bypass policy scoped to Chaser's sending address or domain. Don't use a global toggle.

Similar internal domain: Chaser sends from a subdomain of your own domain, which Mimecast reads as suspiciously similar to your real domain rather than as a trusted sender.

Internal user name: If the chase From display name matches a real employee, this check fires. It's common when the sender is set up as a named person rather than a team mailbox.

Reply-to address mismatch: If your sending domain isn't fully verified in Chaser, the delivery layer rewrites the Reply-To address to one that looks unrelated to the From address, which triggers this check on its own. Completing domain verification in Chaser removes this trigger without needing a Mimecast exception for it.

Important things to know

An anti-spoofing bypass is a genuine reduction in protection against domain spoofing, even when scoped narrowly. It tells Mimecast to trust one more external source claiming your own domain identity. Scope it as tightly as possible, ideally to Chaser's specific sending domain or IP range, and make sure your security team approves the change.

How to confirm it's working

Send a test chase to an internal address. If the bypass is set up correctly, it will arrive in the inbox rather than being quarantined, and you won't see an anti-spoofing rejection in your mail logs.

Still need help? Contact the support team at support@chaser.io and include a copy of the rejection entry from your Mimecast message logs. That's the fastest way for us to confirm what's being triggered.