You need to verify what type of encryption is being used: PGP, S/MIME, TLS, Identity based encryption or Mail sessions encryption.
For SBG, you can assign an MTA TLS certificate to a Scanner. You need to do this if you want the Scanner to accept TLS-encrypted messages for scanning of inbound or outbound mail.
To assign an MTA TLS certificate to a Scanner
1 In the Control Center, click Administration > Hosts > Configuration.
2 Check the box beside the host that you want, and click Edit.
3 Click the SMTP tab.
4 Under eitherInboundMailSettings or OutboundMailSettings, check Accept
TLS encryption if you want this Scanner to scan for inbound or outbound
TLS-encrypted email, respectively.
5 In the adjacent drop-down list, choose the MTA TLS certificate that is
appropriate to the inbound mail flow or outbound mail flow.
You can assign the same certificate to both inbound and outbound
TLS-encrypted email filtering.
6 Check Requestclient certificate if you want the connecting client to present
a TLS certificate for authentication.
This step is required for the inbound mail setting only.
You may need to install an intermediate CA certificate to authenticate the
connecting client's TLS certificate.
7 Click Save.