Definition
DKIM canonicalization is the process of normalising a message's headers and body into a standard form before the DKIM signature is computed and verified. Because a message can be modified slightly in transit — whitespace changed, header casing adjusted — DKIM defines two canonicalization algorithms, simple and relaxed, that determine how strictly these changes invalidate the signature.
How It Works
Canonicalization is applied separately to the header and the body, and the sender chooses one algorithm for each:
| Algorithm | Behaviour |
|---|---|
simple |
Tolerates almost no changes; the content must be byte-for-byte identical |
relaxed |
Allows some normalisation, such as whitespace and header-case changes |
A signature is written with tags specifying the choice, such as c=relaxed/relaxed (header/body), c=simple/simple, or a mixed form like c=relaxed/simple.
When the receiving server verifies the signature, it applies the same canonicalization rules to the received message. If the transformed content matches what was signed, the signature verifies. If the message was altered in a way the chosen algorithm does not tolerate, verification fails.
Why It Matters
The choice of canonicalization affects how robust a signature is to legitimate changes. The key trade-off:
simpleis stricter and more brittle; even minor reformatting by an intermediary can break the signature.relaxedtolerates common modifications, such as header re-folding and case changes, so signatures survive forwarding and list processing more often.
Most modern senders use relaxed/relaxed to maximise the chance that signatures survive transit. The simple algorithm is occasionally used where senders want maximum strictness, but it is rare for bulk email because it is easily invalidated.
Canonicalization interacts with DMARC: a broken DKIM signature can turn an otherwise authenticated message into a DMARC failure, hurting deliverability. Choosing a tolerant canonicalization reduces those false failures.
Example
A sender configures its platform with c=relaxed/relaxed. Its newsletter passes through a list server that reformats header whitespace. Because relaxed canonicalization tolerates the change, the DKIM signature still verifies at the recipient, and the message reaches the inbox.
Was this useful?
Related Glossary Terms
Abuse Complaint
An abuse complaint is a report from a recipient who marks an email as spam, which negatively affects sender reputation and deliverability.
Alt Text
Alt text is the written alternative to an image in an email, displayed when images are blocked, slow to load, or consumed by screen readers.
AOL Mail for Email Marketers
AOL Mail is a legacy email provider with specific deliverability requirements and rendering quirks, now operating as part of the Yahoo+AOL network under shared infrastructure.
Email Authentication Protocols
Email authentication protocols are technical standards that verify the identity of an email sender, helping mailbox providers distinguish legitimate mail from spam and phishing.
BIMI
BIMI (Brand Indicators for Message Identification) is an email standard that allows brands to display their logo next to their emails in supported email clients. It requires DMARC enforcement at quarantine or reject policy.
Bounce Management
Bounce management is the process of handling emails that are rejected by mailbox providers, including classification, removal of bad addresses and protection of sender reputation.
Frequently Asked Questions
Simple tolerates almost no modification, while relaxed allows normalisation such as whitespace and header-case changes. Relaxed is more robust to the changes that occur during normal email transit.
Relaxed for both header and body (`c=relaxed/relaxed`) is the common recommendation for most senders, because it maximises the chance that signatures survive forwarding and reformatting.
Indirectly. A canonicalization choice that is too strict causes valid mail to fail DKIM, which can produce DMARC failures and spam placement. A tolerant choice reduces these false failures.
Changing canonicalization requires republishing the DKIM record and resigning mail, so it is typically done alongside a key rotation or configuration change. Test the change on a small volume before applying it broadly.