DNS Authentication combines three industry-standard email authentication technologies that allow domain owners to control who sends on behalf of their domains. It also validates the authenticity of inbound messages.
1: Login on Mimecast portal and go to Administration > Gateway > Policies

Step 2: Under Policies, go to Definitions > DNS Authentication – Inbound > New DNS Authentication -Inbound Checks

Step 3: exit from Definitions menu. Now click on Go Back option.
Step 4: Under Policies again, go to DNS Authentication – Inbound > New Policy > Provide a policy name and under Select Option, chose a definition that was recently created.

Step 5: Click on Save and Exit