5.3.0 - Other Mail System Problem ("554' 5.6.0 StoreDrv.Deliver ; invalid message content) Cisco -> O365

[rolelael]

Goodevening

I'm handling a strange issue

Mail is received on our cisco ESA which have a connection towards our O365 tenant

One external sender sends mail messages towards one of our O365 users, and this mail bounces with the above error message from O365

I tried more debugging logs, but not any log show me more info ( domain debug etc )

I trapped the emails in our quarantine and saw that the headers contained a large to: header field with more than 250 recipients in it ( only 1 recipient in our O365 & 249 external recipients of other external companies )

I tried searching on the NDR message & O365 but no luck. Could the large To: header be causing this ? Since these recipients are not our recipients, I'm presuming we can not hit receiving/sending limits in our O365 tenant.

If the external user sent an email with only 1 recipient in it, we receive the mail.  But it looks like we are the only one who is complaining and the external user won't take the advise to shorten the recipient list

Any ideas ?

regs

[Libin Varghese · Accepted solution]

The ESA processes and delivers emails based on the envelope recipient (rcpt-to).

To see an email with a single envelope recipient (seen in message tracking) and 250 recipients in the To header (seen in the email headers) would certainly be strange.

The ESA should not have an issue processing and delivering those but certain MTA's may certainly not like it and decide to reject it.

Ideally, the sender should be able to correct whatever is going on with that email resulting in 250 To recipients being added to it.

The ESA does have a content filter FED action that effectively replaces the From header with contents from the envelope sender.

Regards,

Libin

[marc.luescherFRE]

Hi Roel,

this issue is related to a new O365 deployed feature. O365 allows for transport rules to be setup which have the option "defer the message if rule processing doesn't complete" being set.

Should the O365 engine timeout , most commonly when inspecting an Excel or Word file with macros, the sneder will get an 554 5.6.0 Invalid Message Content notification.

Check your O365 rules and disable that tag for now.

-Marc

[rolelael]

Hi this had nothing to do with  attachments and / or transport rules in O365

The to field was merely to big . We simulated it with fake email adresses etc in the to filed via an internal mail relay etc. and got the same error message

Anyway we informed the sender and asked them to split into smaller ones

Regs