Mimecast is an email security gateway: companies point their MX records at Mimecast, which filters inbound mail and forwards the clean messages to the real mailbox host, usually Microsoft 365 or Google Workspace. Spaw reports such domains as mx_provider: "mimecast", and the gateway, not the mailbox host, is what a verification handshake talks to.
How Mimecast shows up in DNS
Domains behind Mimecast publish MX records under mimecast.com, with regional inbound clusters such as us-smtp-inbound-1.mimecast.com, eu-smtp-inbound-1.mimecast.com or service-alpha-inbound-a.mimecast.com, normally as a pair at equal priority. Spaw matches the .mimecast.com suffix. Because the MX target is a filtering layer, mx_provider tells you who guards the domain, not where the mailboxes live; the domain intelligence endpoint reports the gateway and leaves the mailbox host unknown.
How Mimecast answers a verification handshake
A gateway does not know which mailboxes exist unless the customer syncs its directory to it. Mimecast offers directory-based recipient validation, and customers who enable it get clean rejections for unknown recipients at RCPT TO. Many do not, and their gateways accept every recipient during the handshake, pass the message to the mailbox host, and only then discover that the mailbox is missing, producing a bounce after the fact. From the outside that domain is a catch-all, and it is the common answer behind Mimecast. Mimecast also greylists and rate-limits senders it has not seen, which leaves some probes unverified.
What that means for your verdicts
Expect risky with reason: catch_all for most Mimecast-protected domains. Spaw remembers the catch-all answer per domain for seven days, spends no further probes on it, and returns mailbox_confidence for each address instead: Mimecast is on the established-provider list, so the estimate starts ten points up and then moves with the domain's DMARC and SPF, its registration age, whether the username looks like a name, and your own delivery outcomes for the domain. Domains with recipient validation enabled answer cleanly, deliverable with mailbox_exists: true or undeliverable with reason: mailbox_not_found. Unverified probes show smtp_reason: greylisted or timeout; pass callback_url to have them re-checked after 5 and 20 minutes.
Because catch-all is the norm here, your own delivery data is the strongest signal available. A delivered report through the feedback endpoint turns later lookups of that address into a confirmed mailbox with smtp_reason: delivered_recently, and bounces lower the confidence for the whole domain.
SPF and DMARC at Mimecast
Companies that send outbound mail through Mimecast add a regional include to their SPF record, such as include:us._netblocks.mimecast.com or include:eu._netblocks.mimecast.com; the global include:_netblocks.mimecast.com record exists too, but it expands to several regional includes and counts against the ten-lookup limit accordingly. Mimecast's documentation lists the correct include for each region. Inbound filtering does not change the domain's SPF; Spaw reports has_spf and dmarc_policy from the live records as usual.
Practical notes for sending to domains behind Mimecast
Mimecast-protected companies are typically mid-size and enterprise organisations with strict policies: attachments, links and unauthenticated senders are inspected aggressively, and a sender without aligned SPF and DKIM is more likely to be held or rejected here than at a consumer provider. Treat a risky catch-all answer as "the gateway would not say", rank those addresses by mailbox_confidence, and feed outcomes back so the ranking improves.
For a live look at any Mimecast-protected domain, run it through the free MX lookup and the SPF and DMARC checker.