DKIM glossary
What does c=relaxed/relaxed mean in a DKIM signature?
By Samuel Chenard · CEO & Co-Founder, Palisade · Reviewed July 15, 2026
c=relaxed/relaxed sets canonicalization for a DKIM signature. How much the header and body are normalized before hashing. relaxed tolerates whitespace and header-case changes; simple demands a byte-exact match. relaxed/relaxed is the pragmatic default because mail servers routinely reflow whitespace in transit.
c=relaxed/relaxed at a glance | |
|---|---|
| Tag | c (canonicalization) |
| Valid values | header/body, each simple or relaxed: e.g. relaxed/relaxed, simple/simple, relaxed/simple |
| Default | If c= is omitted, DKIM defaults to simple/simple (the strict, byte-exact mode). |
| Where it goes | In the DKIM-Signature header, expressed as header-algo/body-algo. |
How c=relaxed/relaxed works
Before hashing, DKIM canonicalizes the message, normalizes it, so trivial changes don't automatically break the signature. The c= tag sets two algorithms at once: one for the headers, one for the body, written header/body.
simple is byte-exact: change a single character, even whitespace, and the hash no longer matches. relaxed is more forgiving. It collapses runs of whitespace and tolerates header-case changes and folding. relaxed/relaxed is the pragmatic default because mail servers and gateways routinely reflow whitespace and rewrap headers in transit.
simple canonicalization is exactly why some signatures break in flight with no one at fault: a legitimate relay lightly reformats the message, the byte-exact hash fails, and DKIM reports a failure even though the content is genuine. Choosing relaxed removes most of that fragility.
Correct record vs common mistake
Correct
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=example.com; ...Relaxed canonicalization on both header and body tolerates the whitespace and header changes that normal mail routing introduces.
Common mistake
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=example.com; ...Byte-exact on both sides. Any relay that reflows whitespace or rewraps a header breaks the hash. Legitimate mail can fail DKIM through no fault of the sender.
Troubleshooting c=relaxed/relaxed
| Issue | Likely cause | Fix |
|---|---|---|
| Signatures break after forwarding | simple canonicalization fails on any whitespace or header change in transit | Switch signing to relaxed/relaxed so routine reformatting no longer breaks the hash |
| Body hash fails on some paths only | A gateway reflows the body; simple body canonicalization can't tolerate it | Use relaxed body canonicalization; also check for gateways appending footers |
| Intermittent, unreproducible DKIM failures | Fragile canonicalization interacting with specific relays | Move to relaxed/relaxed and re-check reports; failures from reformatting should clear |
Why it matters for MSPs
When client mail flows through forwarders, security gateways, or mailing lists, simple canonicalization turns routine reformatting into DKIM failures. Multiply that across tenants and you get intermittent, hard-to-reproduce failures that look like a spoofing problem but are really a canonicalization choice.
Trusted by MSPs
“I've migrated all my clients from PowerDMARC. The agent was so powerful it allowed us to do the work in a fraction of the time.”
Marc-Olivier Hardy , VP & CTO, CDT ConnexionRead the case study →
DMARC software that does the work
Palisade reads the pass/fail pattern in each client's reports, so signatures breaking from fragile canonicalization stand out. Letting you fix the setup before it costs the domain a clean path to reject.
1 domain free up to 1,000 emails/month
Questions readers ask
Frequently asked questions
What does c=relaxed/relaxed mean?
It sets DKIM canonicalization to relaxed for both the header and the body: the message is normalized (whitespace collapsed, header case tolerated) before hashing, so ordinary reformatting in transit doesn't break the signature.
What's the difference between simple and relaxed canonicalization?
Simple is byte-exact, any change breaks the hash. Relaxed tolerates whitespace collapsing and header-case or folding changes. Relaxed is more robust across real mail routing.
Which canonicalization should I use for DKIM?
relaxed/relaxed for most senders. It survives the whitespace and header reflowing that relays and gateways routinely apply, so fewer legitimate messages fail DKIM.
What is the default DKIM canonicalization?
If the c= tag is omitted, DKIM defaults to simple/simple, the strict, byte-exact mode. Most senders set relaxed/relaxed explicitly instead.