Read both sides of c=

The DKIM c= tag can name header and body algorithms, such as relaxed/relaxed or relaxed/simple. If the tag is absent, RFC 6376 defines a default. Record the actual value instead of assuming the provider uses one mode everywhere.

Header canonicalization and body canonicalization are separate. simple header processing preserves the header field as specified for signing, while relaxed normalizes the field name, unfolding, and certain whitespace. For bodies, relaxed normalizes specified whitespace and trailing empty lines more permissively than simple. Read the exact algorithm before predicting whether a modification survives.

Build a controlled laboratory example

Create a test message with a header containing folded whitespace and a body containing repeated spaces and blank lines. Sign it in a non-production environment. Preserve the original bytes, then make one change per copy:

  1. add trailing empty lines;
  2. change a run of spaces in the body;
  3. refold a signed header;
  4. add a footer sentence.

Verify each copy with a standards-compliant local tool. The footer should not be expected to survive full-body signing merely because canonicalization is relaxed. Record actual outcomes instead of using the exercise to derive a universal gateway rule.

Apply the lesson to a failure

For an affected message, capture c=, the signed header list in h=, and whether the body hash or header signature failed. Locate systems that can refold headers, rewrite MIME, append legal footers, or alter tracking links after signing. Move signing after required transformations where architecture permits.

Do not switch to relaxed canonicalization as a blind fix. It may improve resilience to harmless formatting changes, but it cannot legitimize uncontrolled message mutation and does not fix a wrong key or selector.

Verify the production path

Send representative plain-text, HTML, multipart, and internationalized content through every normal gateway. Confirm fresh trusted receiver results and message rendering. Document the selected modes and the transformations they were tested against. The useful outcome is a stable signature at the final outbound boundary, with canonicalization understood as a precise algorithm rather than a “strict versus forgiving” marketing label.