What is body-hash canonicalization?

Body-hash canonicalization is the step DKIM takes before computing the hash of your email body. "Canonicalization" means normalizing the content into a standard form before signing it. Without it, tiny formatting variations that happen in transit would cause constant signature failures, even when the actual message wasn't tampered with.

Why normalization is needed

Email bodies aren't always byte-for-byte identical between send and receipt. Trailing spaces get added or stripped. Line endings switch between CRLF and LF formats. Some mail relays add blank lines. If DKIM hashed the raw body as-is, these invisible differences would break signatures even on completely unmodified mail.

Canonicalization standardizes the body before hashing so that both sender and receiver are working from the same normalized version, regardless of minor transit changes.

Simple vs relaxed body canonicalization

And there are two modes:

• Simple: Only strips trailing empty lines at the very end of the body. Everything else must match exactly. One extra space, one different line ending, and the signature breaks.
• Relaxed: Strips trailing whitespace from each line, normalizes runs of whitespace to a single space, and ignores trailing empty lines. It survives most minor transit reformatting.

Relaxed is what nearly every ESP defaults to, and rightly so. Simple mode fails on any mail path that touches the body, and quite a few do.

The c= field in your signature

DKIM has two canonicalization settings: one for headers and one for the body. They're listed as a pair in the DKIM-Signature header's c= field. You'll see something like c=relaxed/relaxed (header/body) or c=relaxed/simple. Most senders run relaxed for both.

You can see your current settings by pasting a received email into our email header analyzer. If you're investigating body-hash failures (dkim=fail where the signature is present but not verifying), the SOS hotline is free.