https://community.mimecast.com/docs/DOC-2545#jive_content_id_Inbound_DNS_Authentication_Policy_Configuration You can also tighten down SPF to only allow specific email address to send from third party services instead of whole domain : https://www.jamieweb.net/blog/using-spf-macros-to-solve-the-operational-challenges-of-spf/