ESA bodyhash_mismatch

[Patrick Flender]

Hello everyone,

i'm working on a case and maybe someone is able to give me suggestions. 

There is a Mail coming from Exchange Online via Connector to Exchange OnPrem and from there sent to ESA. The Message has a 550 Failure with status fail/bodyhash_mismatch. From what i know if anywhere in the mail chain the mail is changed in body/header this mismatch occurs. We cannot figure out where the message is changed. 

I thought about a workaround: Would it be possible to Strip the header part of the DKIM via Filter and sign it new for sending. Or if the mismatch appears its not possible to sent it on? 

Thanks

[Ruben Cocheno]

@Patrick Flender 

Go to the Message tracker and see what happens to that type of emails, below is how to trace it

https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118552-qa-esa-00.html