Mimecast blocking all Gainsight Emails

Our IT group is planning to use Mimecast and I am concerned about potential Gainsight email issues. Currently we have several whitelisted Gainsight domains in our email server configuration including gainsightcloud.com, gainsight.com, gainsightdev.com, and gainsightapp.com.

We will not be allowed to whitelist an entire domain with Mimecast. For Mimecast we are being asked for specific Gainsight email addresses that should be whitelisted.

I submitted a ticket to Gainsight support requesting this info and the response was to whitelist  noreply@gainsight.com and no-reply@gainsight.com. I suspect there is more to it than just those two email addresses.

Can anyone who has Gainsght running with Mimecast provide some insight or tips?

Thank You!

Hello @smurray 

Let me check with my team and update you about this.

Hello All,
https://community.mimecast.com/s/article/Stationery-Email-Best-Practice-1598993230 please check this for the information on mimecast.

Our IT team implemented Mimecast and we have been working the past several weeks to get it working for things like surveys, newsletters, and reports where we are copying or sending email from Gainsight to internal Gainsight users. I am sure others will struggle with this as well so I wanted to post some of the things we found that may help. Note that this info is specific to our implementation so don’t view it as a checklist, but some things to look at it in your implementation.

The first thing you need to understand is that Mimecast is designed to block spam, and Gainsight emails look like spam. Gainsight sends email on your company’s behalf from a source outside of your company’s network and this looks like spam. You are going to have to test and tune Mimecast for every Gainsight email type and program you are expecting email from Gainsight to go through Mimecast.

The first step is configuring Mimecast to generally allow email from Gainsight to pass through from expected sources. There is no one place you can get this info from Gainsight, but through a couple of support cases this is what we found:

1. Add IP addresses that Gainsight sends email from: 198.37.159.181, 167.89.37.232, 167.89.37.164
2. Add domains that Gainsight may send email from:  @sgemail.gainsightapp.com, @gemail.gainsightapp.com, and gsemail.mycompany.com (where mycompany.com is your company)  
3. Add email addresses that Gainsight sends email from:                                          no-reply@gainsightapp.com, and noreply@gainsight.com .  
4. Add your company email addresses that Gainsight sends email on your behalf for things like NPS surveys, customer satisfaction surveys, and newsletters. For us, it was email addresses like   experience@mycompany.com  and   support@mycompany.com (where mycompany.com is your company).

Once you have the basics above completed, you can begin testing. I’ll repeat that you will need to test every program type that you are expecting to receive email from. I will caution you that just because you can see Gainsight emails are coming from one program does not mean it is working for others. When you are testing you will want to be working with both your Mimecast and Gainsight admins to monitor the Mimecast logs and Gainsight logs together in real-time to work through what Mimecast is filtering. 

If your company is using Mimecast, all users have access to their Mimecast personal portal at https://webmail-uk.mimecast.com/u/login/?gta=portal#/login or similar. In this portal, you can view emails sent to you that Mimecast has blocked or rejected. This can be a very helpful tool to see what Gainsight emails are being blocked. In this portal you can whitelist emails that you want to pass through Mimecast that have been blocked, but I have found that this does not overrule the global Mimecast policies implemented. So use it more as a tool to see what is being blocked.

During the process of testing, you are going to have Gainsight emails sent to you bounce. I am not sure what the limit is, but after a certain amount Gainsight is going to add your email address to their bounce list and will no longer send emails to your email address. There is not a notification, it just stops working. If you are testing and your Mimecast admin says they are not seeing any emails being rejected by Mimecast, but you are not receiving them, it is likely Gainsight added your email to the bounce list. You can fix this problem in Gainsight by going to Administration->Email Validator to see if your email address or others are on the bounce list (and remove it). This seems like a Gainsight bug because licensed users should never be added to this list, but it happens.

When running reports in Gainsight sometimes you want to Export to CSV. Gainsight then sends you an email with an attached CSV file, and Mimecast will likely block it because of the contents of the CSV file. This can be a hard problem to fix because it is the contents of the CSV file itself rather than where it is coming from that is causing Mimecast to block the email. You can try sending smaller CSV files by limiting the line items in the report which seems to help but not always. Gainsight needs to develop a different way to get this info (maybe provide the file to download rather than attach in email, or the ability to export directly to a file locally)     

If your Mimecast policies are really strict Gainsight emails may never go through. If your Mimecast is set up to “not trusting” DKIM signing discrepancies it would reject/quarantine these emails. if your IT team decides to use strict aspf or adkim policy you are going to have failures. You can work with Gainsight support to help you with this, but it will have to be escalated a few times until you get to a Support Lead that will be knowledgeable on the topic.  

Unfortunately, Gainsight does not appear to be taking a proactive approach to the many issues you are going to run into with Mimecast. There is no real documentation that I could locate and almost all references to documentation were on some other website. The external links are good background info they do not provide solutions. You will be mostly on your own to resolve the issues so become good friends with your Mimecast admin.

hello @smurray 
I will arrange for a session where we can discuss what support is needed form our end.