Message Trace shows TLSversion as 'none' but mailheader shows TLS 1.2

%3CLINGO-SUB%20id%3D%22lingo-sub-2321957%22%20slang%3D%22en-US%22%3EMessage%20Trace%20shows%20TLSversion%20as%20'none'%20but%20mailheader%20shows%20TLS%201.2%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2321957%22%20slang%3D%22en-US%22%3E%3CP%3EI%20have%20a%20daily%20PS%20script%20checking%20inbound%20and%20outbound%20mails%20through%20our%20tenant%20to%20verify%20if%20they%20are%20sent%20with%20TLS.%3CBR%20%2F%3E%3CBR%20%2F%3Esince%202%20weeks%20ago%20we%20started%20getting%20false%20positives%20through%20the%20Get-MessageTraceDetail%3CBR%20%2F%3Eit%20tlsversion%3DNONE%20on%20the%20mail%2C%20but%20if%20I%20look%20in%20the%20mailheader%20through%20Outlook%2C%20the%20mail%20has%20indeed%20been%20sent%20with%20with%20Microsoft%20SMTP%20Server%20(version%3DTLS1_2%2C%20cipher%3DTLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384)%3CBR%20%2F%3E%3CBR%20%2F%3Eanyone%20else%20seeing%20this%20or%20know%20what%20has%20changed%20lately%3F%3CBR%20%2F%3EBest%20regards%3CBR%20%2F%3E%3CBR%20%2F%3EFor%20the%20curious%20people%20I%20use%20the%20commands%3A%3C%2FP%3E%3CPRE%20class%3D%22lia-code-sample%20language-applescript%22%3E%3CCODE%3E%20%20%20%20%24allMails%20%3D%20Get-MessageTrace%20-StartDate%20%24DateStart%20-EndDate%20%24DateEnd%0A%0A%20%20%20%20%24allBadMailsDetailed%20%3D%20%24allMails%20%7C%20Get-MessageTraceDetail%20%7C%20Select-Object%20MessageID%2C%20MessageTraceId%2C%20Data%20%7C%20where%20%7B%24_.Data%20-like%20%22*tlsversion%3DNONE*%22%7D%3C%2FCODE%3E%3C%2FPRE%3E%3C%2FLINGO-BODY%3E
Occasional Visitor

I have a daily PS script checking inbound and outbound mails through our tenant to verify if they are sent with TLS.

since 2 weeks ago we started getting false positives through the Get-MessageTraceDetail
it tlsversion=NONE on the mail, but if I look in the mailheader through Outlook, the mail has indeed been sent with with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384)

anyone else seeing this or know what has changed lately?
Best regards

For the curious people I use the commands:

    $allMails = Get-MessageTrace -StartDate $DateStart -EndDate $DateEnd

    $allBadMailsDetailed = $allMails | Get-MessageTraceDetail | Select-Object MessageID, MessageTraceId, Data | where {$_.Data -like "*tlsversion=NONE*"}
0 Replies