DKIM h= Tag Error Fix

What causes a DKIM h= tag error in email verification systems?

You send a verified email, and it bounces. Not with a "user not found" error — but with a cryptic DKIM validation failure. You check the headers, see a h= tag with subject:body, and wonder: why did this fail?

DKIM validation isn’t just about signature syntax. It fails when the h= tag includes field names a receiving server doesn’t recognize. Even if the signature is mathematically correct, a non-standard field entry — like h=x-custom-header or h=subject:body — can trigger rejection.

Key takeaways

DKIM h= tag errors occur when signature fields include names not in the receiving server’s accepted list of headers.
Non-standard field names like subject:body or x-custom-header in the h= tag are often rejected, even if syntactically valid.
Verification systems must validate both syntax and compliance with standard header sets used by target mail providers.

Why does the h= tag matter in DKIM and email deliverability?

The h= tag in DKIM specifies which headers are included in the cryptographic hash used to verify an email’s authenticity. If the list contains unsupported or improperly formatted fields, the signature fails validation, triggering rejection by receivers. This failure undermines sender reputation, increases bounce rates, and can lead to spam filtering — even for legitimate messages.

How the h= tag affects signature verification

DKIM signs a subset of email headers, and the h= tag tells the receiving server which ones to include in the hash calculation. Common examples are "From," "To," "Subject," and "Date." But including unsupported fields — like custom or non-standard headers such as X-Feedback-ID or unrecognized MIME types — breaks the verification process.

Receiving servers follow RFC 6376 (the standard for DKIM), which defines acceptable header fields. If the h= list violates this, the server rejects the signature, regardless of whether the content is valid. For example, some mail transfer agents (MTAs) drop messages with any DKIM signature failure, even if the message appears clean otherwise.

Why verification systems must flag h= tag errors

During email verification, a system must validate not just syntax, but functional correctness of the DKIM signature. If the h= tag references non-standard or invalid headers, the signature is inherently broken. This is a technical detail that most senders miss until they face sudden blockages.

Systems like MailTester’s real-time validation API check for this during delivery simulation, catching h= tag errors before you send. It’s not enough to confirm the email exists — you must also ensure the full technical chain holds. Use the API to catch these issues in high-volume campaigns.

According to industry standards published by the IETF, improper header listings are a common source of DKIM failures. Misconfigurations here do not appear in basic syntax checks but still prevent delivery. RFC 6376 details the expected behavior of signature verification, including header selection.

Even small missteps — like a trailing space in the h= list or a malformed header name — invalidate the signature. This isn’t a cosmetic issue. It’s a core technical failure that impacts deliverability at scale.

Let’s be clear: a DKIM signature isn’t just a digital stamp. It’s a cryptographic contract between sender and receiver. If the h= tag breaks that contract, the message gets flagged — even if it’s legitimate.

How does MailTester detect and flag h= tag errors?

MailTester catches DKIM h= tag errors by validating the signature's header list against RFC standards during real-time verification. It checks each header field listed in the h= tag to ensure only RFC-compliant fields are used—flagging unsupported names like custom or non-standard headers before they reach the inbox.

Testing DKIM in Real-World Conditions

Unlike basic syntax checks, MailTester simulates actual delivery conditions. This includes inspecting the DKIM signature’s h= tag for compliance with established email protocols. The system compares each header listed in the tag against the official set of allowed header fields defined in RFC 6376 and RFC 4871.

Let’s say you see an h= tag containing h=From:Subject:List-Unsubscribe. While these are common fields, if a custom field like X-Tracking-ID appears instead, MailTester flags it as invalid. These non-RFC entries can trigger rejection or spam filtering by receiving servers, even if the message otherwise appears legitimate.

MailTester’s verification engine doesn’t rely on guesswork. It uses a known set of allowable header names based on widely accepted email standards. If a header in the h= list isn’t part of this set—such as a private or proprietary field—it gets flagged as risky. This level of detail helps you avoid sending to addresses where the DKIM signature itself is malformed, reducing bounce rates from strict mail servers.

Detecting Unsupported Field Entries

Some systems accept any header in the h= tag—this is a flaw. MailTester doesn’t. It enforces RFC compliance, so unsupported or poorly named fields don’t slip through. We do this because a malformed DKIM signature, especially one containing non-standard fields, often results in a hard bounce or inbox rejection.

For example, if a mailing list includes an email with a DKIM signature using h=From:Subject:Custom-Field, and Custom-Field is not in the standard list, the signature fails validation when the receiving server checks it. MailTester detects this before the send, helping you clean your list proactively.

Want to verify your entire list with this level of scrutiny? Try our bulk verification tool, which processes every address—including DKIM signature checks—using a real-time, standards-compliant engine.

For developers, our real-time verification API includes full DKIM header validation as part of each check. It returns clear flags when non-standard or unsupported header fields appear in h= tags, so you can fix issues at source or exclude risky addresses.

What field names are officially supported in the h= DKIM tag?

Only standard email header names defined in RFC 6376 are officially supported in the h= DKIM tag. These include from, to, cc, subject, date, message-id, reply-to, content-type, mime-version, and others from the core email structure. Including custom headers like x-api-key or x-tracking-id will trigger a DKIM h= tag error and cause verification failure at the receiving end.

Officially supported header names

DKIM signatures must reference headers that follow the email specifications set by the IETF. The h= tag only accepts field names from the standard MIME header taxonomy, such as from, to, subject, date, message-id, and content-type. These are part of the email envelope and content meta-information that all compliant mail servers expect. Any deviation from this standard breaks DKIM validation.

For example, if your DKIM signature includes h=from:to:cc:subject:x-tracking-id, the presence of x-tracking-id — a non-standard, custom field — will result in a verification failure. This is by design. Receiving servers validate DKIM signatures using the exact header names in the h= tag. If even one header name in that list is not defined in the base email, the signature fails.

Why custom headers cause errors

Custom headers like x-api-key, x-campaign-id, or x-user-token are not part of the RFC 6376 standard and have no defined role in DKIM verification. Including them in the h= tag signals a misconfiguration or poor practice. While some email systems may ignore them, major providers like Gmail, Outlook, and others enforce strict compliance with the RFC. Even one unsupported header in h= will invalidate the DKIM signature at the receiving end.

Let’s be clear: support for custom headers in h= does not exist. The DKIM specification is strict, and receivers check the header names listed in h= against actual headers in the message. If they don’t match exactly, DKIM fails, and the message may be rejected or marked as spam.

For developers and email senders, this means your signing setup must align precisely with the official header taxonomy. If you're building an email verification system or debugging delivery issues, ensure the h= tag only includes the standard fields listed in RFC 6376. If you're testing DKIM signatures, use real test messages and check the full header set.

For automated verification and real-time pre-send checks, MailTester helps detect these misconfigurations early. Verify a single address or use our API to validate DKIM alignment before sending at scale.

How to verify if your DKIM h= tag uses unsupported entries

You can confirm whether your DKIM h= tag includes unsupported header fields by inspecting the full DKIM-Signature header in your email’s raw mail log or via a header analyzer like MxToolbox. Extract the h= tag, list all fields included, and compare them against the official header field list defined in RFC 6376 Section 6.1. Any field not in that list is invalid and breaks DKIM validation.

Steps to verify and fix unsupported h= entries

Retrieve the full DKIM-Signature header
Use your mail server logs, an email client’s raw header view (like Gmail’s “Show original”), or a tool such as MxToolbox to access the complete DKIM-Signature header. The header must include the full signature line, not just a truncated version.
Parse the h= tag
Look for the h= tag within the DKIM-Signature header. It lists the header fields used in the signature hash, separated by colons (e.g., h=from:subject:to). Copy each field name exactly as listed, including case, to analyze later.
Compare against RFC 6376 Section 6.1
The only header fields allowed in DKIM’s h= tag are those explicitly defined in RFC 6376 Section 6.1. These include standard fields like from, to, subject, date, cc, bcc, message-id, reply-to, and others. Any field outside this list—like x-custom-header or list-unsubscribe—is unsupported and invalid.
Remove unsupported fields
If you find any fields not in the RFC list, remove them from the h= tag in your DKIM signing configuration. Over-signing with non-standard headers invalidates the signature, even if other parts are correct.
Re-sign and retest
After updating your signing setup, send a test email and recheck the DKIM-Signature header. Confirm the h= tag now contains only RFC-approved fields. Use inbox placement testing to ensure the signature now passes validation across major email providers.

Why this matters

DKIM checks rely on a consistent, predictable hash of specific header fields. Including custom or invalid fields causes DKIM failures, even if the rest of the setup is correct. This results in emails marked as non-authenticated, reduced deliverability, and increased risk of being flagged as spam. Using tools like MailTester’s email checker can help catch these issues during pre-send validation, before they impact your sender reputation.

Common examples of invalid h= field entries causing verification errors

You're seeing a DKIM h= tag error due to unsupported header fields in your verification system. The h= tag defines which headers are signed; if it includes non-standard or invalid entries like body, custom headers, or unknown keys, the signature fails validation. This breaks email authentication and can trigger spam filters, even if the message content is correct. RFC 6376 specifies only standard, well-known headers should be listed — anything else is rejected by compliant receivers.

Standard headers only — no exceptions

DKIM signing must use only headers defined in the SMTP RFCs. For example, h=subject:body fails because body is not a header at all — it's the message content. Headers are metadata preceding the body. Using body in the h= tag is a syntax error and will cause verification to fail. The same logic applies to any non-header field: the signing algorithm expects a list of known header names, not content or pseudo-headers.

Custom and unknown fields break DKIM

When you include custom headers like x-tracking-id or extra-header in the h= tag, you’re asking the verifier to sign data that isn't part of the standard email format. These fields may be present in your email, but they are not included in the list of permitted headers defined in RFC 6376. Even if your system adds them, they’ll be rejected by strict validators during the DKIM signature check. Similarly, using random-key in the h= tag introduces an unknown field that cannot be validated, directly causing a verification failure.

Let’s say your DKIM header is set to h=message-id:reply-to:to:from:random-key. The first four fields are valid, but random-key is not in the RFC list. Even one invalid entry nullifies the entire signature. This is not just a best practice — it’s enforced by email receivers and authentication gateways. You can test whether your DKIM configuration validates correctly using tools like MXToolbox's DKIM Checker or by sending a test message through an inbox placement tool to see how it lands in inboxes.

Proper DKIM setup requires pruning custom or unused headers from the h= list. Only use standard headers: from, to, subject, date, message-id, reply-to, cc, content-type, and similar. If your email system is injecting arbitrary header names, consider filtering them out before signing. For ongoing verification and error detection, use a service like bulk email verification to catch invalid DKIM setups before they impact deliverability.

How Email Verification Systems like MailTester Prevent h= Tag Failures

MailTester’s real-time verification API checks the full email stack—including DKIM signature syntax and header inclusion—so you catch h= tag errors early. When an h= field contains non-standard or unsupported entries, MailTester flags the address as 'risky' and provides a clear verdict, letting you correct issues before sending at scale. This proactive step reduces deliverability risk from misconfigured DKIM signatures.

How DKIM’s h= Tag Works and Why It Matters

The h= tag in a DKIM signature specifies which headers are included in the hash calculation. If the list includes fields not allowed by the signing domain or a known standard, the signature fails validation. Misconfigured or unsupported fields—like custom headers not in the canonical list—cause h= tag errors that break DKIM checks. These errors often lead to emails being rejected or marked as spam, even if the content is valid.

Standard header names such as From, To, Subject, and Date are well-defined in RFC 6376, the foundational DKIM specification. Any deviation—like including a non-standard field like X-Tracking-ID—can invalidate the signature unless explicitly defined. Email verification tools that skip header-level validation miss these subtle but high-impact failures.

How MailTester Catches These Issues Before They Happen

MailTester’s API doesn’t just check if an email exists—it validates the complete envelope, including the DKIM signature structure. It parses the h= tag, verifies all listed fields are standard, and checks that they appear in the correct canonical form. If a field is unsupported, outdated, or misformatted, MailTester returns a 'risky' verdict instead of 'valid'. For example, it detects when a signature lists two To headers or references a non-canonical version of the Received header.

You can use this insight to refine your email template or signing process before deployment. For example, if you see a batch of addresses flagged as risky due to h= issues, you can audit your sender stack for unexpected headers added during routing or automation. This reduces the chance of sending to valid but technically invalid addresses that fail DKIM checks in production.

Try it live: test individual addresses with our email checker or verify a full list with our bulk verification tool. You can also integrate verification into your workflow via our real-time verification API. With a 98.9% accuracy rate and credits that never expire, you’re always ready to send with confidence.

How to fix h= tag errors in your email verification system

DKIM h= tag errors occur when your email signature includes unsupported or non-standard header fields. To fix this, inspect your DKIM-Signature header, identify the h= value, remove any custom or non-RFC-compliant header names (like x-, custom prefixes), and re-sign your message using only standard headers: from, to, subject, date, message-id, and content-type. Validate the fix with a tool like MailTester before rolling out changes.

Diagnose the h= tag issue

Review your DKIM-Signature header and extract the h= value. This field lists the headers used in the signature. A common mistake is including non-standard fields like X-Forwarded-For or Message-ID-Override in this list.
Validate header names against RFC 6376 — the standard governing DKIM. Only headers defined in the RFC are supported by most receiving servers. Fields with prefixes like x- or custom- are not allowed and will trigger h= errors.
Remove unsupported headers from the h= list. Retain only from, to, subject, date, message-id, and content-type. These are the core standardized fields used in most DKIM implementations.

Re-sign and validate

Re-sign the email using only valid header fields. Generate a new DKIM signature with only the approved headers included in the h= value. Tools like the DKIM specification (RFC 6376bis) define which fields are allowed.
Test the signature with MailTester’s inbox placement checker to verify it passes deliverability checks. This ensures your signature is both syntactically correct and compatible with major email providers. Use MailTester’s inbox placement tool to simulate real-world validation.
Roll out changes after thorough testing. Monitor bounce rates and delivery success rates post-deployment. If issues persist, revisit the h= value and ensure no unintended headers were added during transmission or processing.

Proper DKIM setup prevents rejection even if the email content is valid. The h= tag is the blueprint — if it's wrong, the signature fails.

When DKIM h= errors occur despite correct field names

DKIM h= errors can appear even when header names are technically correct because some domains include non-standard or custom headers—like X-Track, X-Source, or other vendor-specific fields—in the h= list. These fields aren't in the RFC 6376 standard and may be added for tracking or analytics. While a few receivers accept them, most will reject messages with unknown or non-compliant fields in h=, causing validation failure. Use only standard headers to avoid compatibility issues.

The 3 steps described in “Diagnose the h= tag issue”, in order.

Custom headers can break DKIM validation

Let’s say your email system appends X-Tracking-ID to every outgoing message. It’s useful for your analytics, but it’s not part of the standard DKIM-approved list. If your DKIM signature includes this field in the h= tag, receiving servers that strictly follow RFC 6376 will reject the signature—even if all other field names are valid. This is why even a correct header name can trigger a failure.

Many legacy systems or older marketing platforms still use non-standard headers without checking compliance. Over time, these slip into signatures during integration, especially if no validation step checks the header list. It’s not uncommon to see fields like X-Message-ID or X-Email-Source in h= tags, even though they are not defined in the standard.

Best practice: only standard headers in h=

The safest approach is to include only headers defined in RFC 6376, such as From, To, Subject, Date, and Message-ID. These are universally recognized and less likely to trigger rejection. Tools like MailTester’s bulk verification can identify these errors early by testing actual message signatures against common recipient policies.

If you must use custom headers, consider moving their data into the body or a separate field like a MIME header—never include them in h=. Receiving servers prioritize RFC compliance above all, especially those using DMARC enforcement or strict DKIM checks. Even one non-standard field in h= can result in the entire message being marked as unverifiable.

How MailTester improves deliverability by catching h= tag issues early

You can prevent DKIM signature failures—like those caused by unsupported or malformed h= tag entries—before they hurt deliverability. MailTester’s 98.9% accuracy catches invalid or risky senders in bulk, including malformed DKIM signatures, before your campaign launches. Integrated with Mailchimp, HubSpot, and SendGrid, it validates lists in real time, ensuring your sender reputation stays strong.

How it works: catching h= tag errors early

MailTester checks every DKIM signature during verification, flagging entries with unsupported or malformed h= fields—common causes of authentication failure.
It identifies invalid or risky addresses in bulk lists before you send, so you don’t waste bandwidth on addresses with broken signatures.
Malformed DKIM structures—especially those with incorrect h= values—are flagged as “invalid” or “risky,” preventing them from affecting your sender score.
Using actual SMTP and MX validation, not just syntax checks, MailTester confirms whether an email address is truly deliverable, not just syntactically valid.
Every verification result includes precise feedback: if a DKIM signature is invalid due to an unsupported h= entry, the system reports it clearly—no guesswork.

Seamless integration with your workflow

Link your Mailchimp, HubSpot, or SendGrid account to MailTester’s integrations to validate email lists before every send.
Use the real-time verification API to scrub new sign-ups or imported data instantly, preventing bad addresses from entering your campaign.
Run bulk verification on high-volume lists to catch systemic issues—like widespread DKIM signature problems—from impacting inbox placement.
Test deliverability with inbox placement testing to confirm your emails reach inboxes, not spam folders, even after correction.
With 100 free verifications to start and credits that never expire, you can maintain long-term list hygiene without overcommitting budget.

A well-formed DKIM signature is essential to trust-based email delivery. The h= tag in particular must reference valid header fields—anything else breaks the signature chain. RFC 6376 defines the correct format. If your system uses invalid or unsupported h= entries, your emails may be rejected—or worse, marked as spam. MailTester finds these issues before they harm your reputation.

Conclusion: Prioritize RFC compliance for reliable DKIM and inbox placement

Unsupported field entries in the DKIM h= tag are a silent but impactful cause of email deliverability failure. Even if the email appears to send, misconfigured headers can lead to rejection by modern MTAs that enforce strict RFC compliance.

Minor errors in DKIM headers, such as invalid or unsupported fields, can degrade sender reputation over time. These issues are often missed during testing but consistently flagged by recipient systems during real-world delivery.

Using a real-time verification tool like MailTester ensures your DKIM configuration meets RFC standards before messages go live. It checks for header validity, alignment, and consistency — reducing the risk of rejection and improving inbox placement.

Sources

Since May 5, 2025, Microsoft Outlook requires SPF, DKIM, and DMARC from domains sending 5,000+ emails per day, rejecting non-compliant mail outright at the SMTP level with error 550 5.7.515. — Microsoft Outlook requirements (via MailOver bulk-sender requirements guide) (2025)
The effective spam-complaint target for 2026 has tightened to below 0.1%, down from the historical 0.2–0.3% tolerance, as mailbox providers raise the bar for senders. — Validity 2026 Email Deliverability Benchmark Report (via The Agile Brand Guide) (2026)

Keep reading

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

What does DKIM h= mean in an email signature?

The h= tag in a DKIM signature lists the header fields included in the hash calculation. Only RFC-compliant fields are allowed.

Can custom headers be included in the DKIM h= tag?

No. Custom or non-standard headers (e.g., x-tracking-id) are unsupported and will cause the signature to fail validation.

Why does my email get blocked despite valid DKIM?

Because DKIM includes a malformed h= tag with unsupported fields, even if the signature itself is syntactically correct.

How does MailTester detect h= tag errors?

It checks the DKIM-Signature header during real-time verification and flags any unsupported field names.

Are all email verification tools capable of checking DKIM h= tags?

Few do. MailTester is among the few that validates the full DKIM structure, including h= field compliance.

Can the h= tag be too long?

Yes. Including too many fields, especially non-standard ones, can trigger validation errors due to server-side filtering.

Does h= tag error affect inbox placement?

Yes. Recipients may see the email as unauthenticated or rejected, especially if the error is repeated across multiple messages.

Is it safe to remove headers from the h= tag?

Only if they're non-standard. Removing required standard headers like from, subject, or message-id breaks the signature.

What is the RFC standard for DKIM h= tags?

RFC 6376 defines the allowed header names. Only standard email headers (from, to, subject, etc.) are acceptable.

How can I test my DKIM signature for h= tag issues?

Use tools like MxToolbox, check raw headers in Gmail, or test with MailTester’s real-time API for full validation.

Do all email providers enforce h= tag compliance?

Most major providers enforce RFC compliance. Non-standard h= entries are often rejected without notification.

Can a DKIM h= error be detected without sending an email?

Yes, with tools like MailTester that simulate delivery and verify signatures in bulk without sending.