r/sysadmin•
Awol

Need Help: Office 365 DKIM Failure (wrong body hash)

I need some help cause I just do not know where the problem lies or even where to go to start poking around. I am getting a DKIM failure on outgoing emails from Office365. DKIM testers are reporting the DNS is working and "correct" but an actual email test gives me this error.

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=domain.com;

 s=selector1;

 h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

 bh=6cMcViI/xvdQwls9H/B9ANdzy/iWUd4nbFUpj1+bQUE=;

 b=Gh+Xp3a4lg8/3qLxHn5oS6Yd4Gcs0gRD4u7ySB6tDBPAJs8ShUjHv7Mwpxt1sIEWkqZ53Dy3yjTr7mJ+qUAyceZfS5RX53KqGsGAeZK+NMjr2s25Y0IEMZj9k8y/avtnv52N1zSLN7zQdhlhLdtOuO2VrukiWPLWNJmkJNLW82Q=

Signed-by: [email protected]

Expected-Body-Hash: FFvi8Fy89gpyVQppK0NwPGY+kbjxkS0RJArPNNcp0nA=

DKIM-Result: fail (wrong body hash: 6cMcViI/xvdQwls9H/B9ANdzy/iWUd4nbFUpj1+bQUE=)

I know this is telling me either the body of the message was edited or a wrong key is being used someplace. For our organization email is flowing from Office365 to Mimecast for archiving outgoing mail. Thinking this was the issue I setup DKIM in Mimecast. Based on the selector in the header Office365 DKIM is being used but I have no idea if Mimecast is changing anything in the body to cause a hash failure. I am at a loss in where to look at this point and could use some help.

UPDATE: This is a problem happening in Mimecast. I turned off the connector to Mimecast in Office365 and I started to pass DKIM test for hashes.

Posted Jul 24, 2019, 12:55 PM UTC · edited

07
cmorgasm•

Try disabling the DKIM signing in O365 in the exchange admin center, see if that helps. We did that to avoid possible double signing issues

2
AwolOP•

Ok I have completely turned off DKIM but yet Office365 is still adding a DKIM signature. I know its Office365 as it is listing its selector.

New info... believe the problem is on Office365 side. I turned DKIM signing back and and told it to rotate keys so it should be using selector2 but its still signing with selector1...

1
wanderingbilbyJack of All Trades•

It takes time for those settings to propagate. Give it a couple hours and try again.

2
AwolOP•

Yes I just noticed that it said it was still rotating. Going to take a small break and check it later.

2
cmorgasm•

Are these internal to external, or internal to internal emails? Did you disable the DKIM signing for the onmicrosoft.com domain, too?

2
AwolOP•

These are internal to external and currently only have mydomain.com enabled. onmicrosoft.com is disabled.

1
cmorgasm•

Disable both. You want mimecast to do the DKIM signing

2