Skip to content
ecdsa.com

DKIM canonicalization

The two algorithms, simple and relaxed (RFC 6376 §3.4), that normalize a message's headers and body before DKIM hashing, chosen independently for headers and body with the c= tag.
Also written asDKIM simple canonicalizationDKIM relaxed canonicalizationc=relaxed/relaxed

simple header canonicalization changes nothing; relaxed lowercases header names, unfolds continuation lines, compresses runs of whitespace to one space and removes whitespace at line ends and around the colon. simple body canonicalization only removes empty lines at the end (an empty body becomes a single CRLF); relaxed also ignores trailing whitespace on each line and compresses whitespace runs. The default is simple/simple; most signers use c=relaxed/relaxed.

Body-hash mismatches (body hash did not verify) usually mean something rewrote the body after signing: a footer, line-ending conversion, re-encoding of quoted-printable or base64 parts, or line wrapping. Header signature failures often come from header reordering or re-folding by gateways, which relaxed tolerates and simple does not. The DKIM debugger shows the canonicalized bytes it hashed.

Standards and references

All terms