C100 Cloud Email Security Appliance

[MB6568]

Today I'm tyring to set up a printer to use HPEprint services.  When sending an email from inside our domain we get a bounce back for HPEprint.com

We are not having any other issues.  We just can't send an email HPEprint.com.  Here is what the logs from the C100

04 Feb 2021 02:33:24 (GMT +05:00)	SMTP delivery connection (DCID 926569) opened from Cisco IronPort interface 139.138.47.215 to IP address 15.72.48.225 on port 25.
04 Feb 2021 02:33:25 (GMT +05:00)	Delivery connection (DCID 926569) successfully accepted TLS protocol TLSv1.2 cipher XXXX-RSA-AES256-XXX-SHA384 None.
04 Feb 2021 02:33:25 (GMT +05:00)	(DCID 926569) Delivery started for message 1417055 to xxxx@hpeprint.com.
04 Feb 2021 02:33:25 (GMT +05:00)	(DCID 517346) Message 1417055 to xxxx@hpeprint.com bounced by destination server. Reason: 5.3.0 - Other mail system problem ('550', ['5.7.0 bad DKIM signature data'])

Anyone have any idea how to get around this issue?

[ciscomoderator]

Hello @MB6568  !

We currently have an Ask Me Anything event (Feb 1-12, 2021) and your question fits our theme:

"New Capabilities to Protect Your Users with Cisco Secure Email - AMA"

For our experts' response, visit the link https://community.cisco.com/t5/email-security/new-capabilities-to-protect-your-users-with-cisco-secure-email/m-p/4286919/highlight/true#M21821

Come and ask more questions before February 12.

Note: If the reply solves your question, please accept their post as a solution to help other members. Thank you! 

[Libin Varghese · Accepted solution]

The issue you are seeing appears to be common among many users emailing to hpeprint.com and has multiple hits on google search.

Possible solution for you to implement on the ESA:
Mail Policies > Signing Profiles > click on the profile > Canonicalization: Set Headers and Body section to Relaxed > Submit > Commit

You will want to do this for other Profiles that send to hpeprint.com.

There was some other tips shared on the HP site regarding this same error as well, you can read them here: https://h30434.www3.hp.com/t5/Printers-Archive-Read-Only/550-5-7-0-bad-DKIM-signature-data/td-p/1645649

The article mentions that the email not having a Subject can lead to these errors.

Also, depending on your setup you may want to ensure the email is signed at the final hop and not modified thereafter.

Regards,

Libin

[MB6568]

I just made this change to our only profile\mail policy but it still is getting the same message when trying to send to hpeprint.com

I looked at the other link but didn't seem to help either.  We just bought this printer and need to get this working or have to go a different direction.  

Any other suggestions?

Thanks in advance.