Need Help: Office 365 DKIM Failure (wrong body hash)
I need some help cause I just do not know where the problem lies or even where to go to start poking around. I am getting a DKIM failure on outgoing emails from Office365. DKIM testers are reporting the DNS is working and "correct" but an actual email test gives me this error.
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=domain.com;
s=selector1;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=6cMcViI/xvdQwls9H/B9ANdzy/iWUd4nbFUpj1+bQUE=;
b=Gh+Xp3a4lg8/3qLxHn5oS6Yd4Gcs0gRD4u7ySB6tDBPAJs8ShUjHv7Mwpxt1sIEWkqZ53Dy3yjTr7mJ+qUAyceZfS5RX53KqGsGAeZK+NMjr2s25Y0IEMZj9k8y/avtnv52N1zSLN7zQdhlhLdtOuO2VrukiWPLWNJmkJNLW82Q=
Signed-by: [email protected]
Expected-Body-Hash: FFvi8Fy89gpyVQppK0NwPGY+kbjxkS0RJArPNNcp0nA=
DKIM-Result: fail (wrong body hash: 6cMcViI/xvdQwls9H/B9ANdzy/iWUd4nbFUpj1+bQUE=)
I know this is telling me either the body of the message was edited or a wrong key is being used someplace. For our organization email is flowing from Office365 to Mimecast for archiving outgoing mail. Thinking this was the issue I setup DKIM in Mimecast. Based on the selector in the header Office365 DKIM is being used but I have no idea if Mimecast is changing anything in the body to cause a hash failure. I am at a loss in where to look at this point and could use some help.
UPDATE: This is a problem happening in Mimecast. I turned off the connector to Mimecast in Office365 and I started to pass DKIM test for hashes.
Posted Jul 24, 2019, 12:55 PM UTC · edited
Try disabling the DKIM signing in O365 in the exchange admin center, see if that helps. We did that to avoid possible double signing issues
Ok I have completely turned off DKIM but yet Office365 is still adding a DKIM signature. I know its Office365 as it is listing its selector.
New info... believe the problem is on Office365 side. I turned DKIM signing back and and told it to rotate keys so it should be using selector2 but its still signing with selector1...
It takes time for those settings to propagate. Give it a couple hours and try again.
Yes I just noticed that it said it was still rotating. Going to take a small break and check it later.
Are these internal to external, or internal to internal emails? Did you disable the DKIM signing for the onmicrosoft.com domain, too?
These are internal to external and currently only have mydomain.com enabled. onmicrosoft.com is disabled.
Disable both. You want mimecast to do the DKIM signing