Random Remote Server returned '554 5.6.0 Corrupt message content NDR emails

Question

I have been getting reports of random NDR's with error code Remote Server returned '554 5.6.0 Corrupt message content; STOREDRV.Deliver.Exception:ConversionFailedException.ConversionFailedException.TextConvertersException; Failed to process message due to a permanent exception with message The message content has become corrupted. ConversionFailedException: Content conversion: Body conversion failed. [Stage: PromoteCreateReplay]'.

The last one reported was a user that was accepting an internal meeting invite. I did some powershell searching to see how often this has happened over the last 3 months. It has happened about 25 times during that time period. I checked with a couple of users and found the emails in question had attachments. The both had a word file attached.

This seems to be sporadic. How would I go about identifying if the issue is caused by Outlook or if it is caused by Exchange? I have seen a couple posts about disabling antivirus but I want to first know on what side the issue is occurring.

Once the user gets the NDR the email is corrupt. From that point nothing can be done with the email except delete it.

If anyone has any ideas how to identify what is causing this please let me know.

Thanks,
TD

Answer 1

@Andy David - MVP please see my previous post.

We can close this as unresolved. We will manage the issue until we switch to Exchange online.

Thanks for everyone's input.

Answer 2

Hi @TRDx2 ,

Have you set any transport rules to check the emails?
And what;s the version of your Exchange server?

If you're using O365, please see this article:
https://learn.microsoft.com/en-us/exchange/troubleshoot/email-delivery/invalid-message-ndr
This issue may occur if the following conditions are true:

1. A transport rule is set up that has the Defer the message if rule processing doesn't complete option enabled.
2. During text extraction, the scanning process timed out when inspecting the attachment.

If that's not the case, then I think something is trying to or having changed the type of your email format.
You don't have to disable AV, check if there are some options that do effect the email context.

Best regards,
Lou

---

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 3

Hi Lou,

Thanks for responding. To answer your questions, We are using a 4 node DAG running Exchange 2016.
None of our transport rules have defer the message if rule processing doesn't complete enabled.

This issue is intermittent and I am not sure what would be changing the email format. I think I will start by getting with our anti-virus vendor and see if they have something that would be causing this. If I can't find anything there. I will see about disabling add-ins for Outlook. Not sure where to go after that.

I am open if anyone has any guidance on what to check.

Thanks,
TD

Answer 4

Does it happen using OWA or Outlook in online mode?
How about when using /safe mode in Outlook?

Answer 5

The issue with testing is that it happens randomly. It may be several days before anyone in the company may get the error. Getting all users to make sure they open Outlook in safemode is not possible. Disabling add-ins is problematic as if the error doesn't happen with in a few hours the users start calling to get their add-ins enabled again.

We don't do any attachment scanning from clients or Exchange. Asking all our users to stop using Outlook and start using OWA is not possible.