Dropbox documentation states two headers are sent with the verification request.
https://www.dropbox.com/developers/reference/webhooks
Content-Type
X-Content-Type-Options
I did not get either header. I did get a user agent of DropboxWebhooks/1.0 with the proper challenge option, but no headers. I think your documentation is wrong, outdated, or you have a bug.