Why does DKIM h= tag alignment matter for email deliverability?

You sent a perfectly formatted email. The DKIM signature checks out. So why did it land in spam—or vanish without a trace?

The problem isn’t always the signature’s math. It’s the h= tag field list. If the headers named in h= don’t match the actual headers in your message, the email will fail verification—even if the cryptographic proof is flawless.

Every time an email arrives, providers like Gmail, Outlook, and ProtonMail don’t just check the signature. They validate the header list in h= against what’s in the message body. A single missing, extra, or mistyped header name breaks the match.

Key takeaways

  • DKIM h= tag must list only headers present in the actual email message to pass verification
  • Even a single misspelled or extra header in h= can cause email rejection or spam filtering
  • Spam engines validate both the DKIM signature and header alignment independently

What exactly is the DKIM h= tag field list?

The DKIM h= tag lists the email headers that were included in the cryptographic signature. It appears in the DKIM-Signature header like h=From:Subject:Date:, and only headers listed there are signed. Recipients verify this by checking whether the actual message headers match exactly—any mismatch fails verification.

How the h= field works in practice

When a message is signed, the sending server selects which headers to include in the signature using the h= tag. For example, if you sign From:Subject:Date:, only those headers are part of the hash. If the receiver finds h=From:Subject:Date: in the signature but the message includes a Reply-To header that wasn’t listed, the signature fails—even if the rest is correct.

Let’s say you send an email where the h=From:Subject:Date:Message-ID is in the DKIM-Signature. The receiving server will extract the actual headers from the message body, hash them in the same order, and confirm they match the signed list. If even one header is missing or an extra one is present, the verification fails.

A common mistake is including headers that change often—like Message-ID or Received—since delivery systems often add or modify them. If you include a dynamic header in h= without controlling it, the signature will break. The rule is simple: only include headers that remain fixed from send to receive.

Why alignment with actual headers matters

DKIM is not just about encryption—it’s about authenticity. The h= field ensures the receiving server knows exactly what was promised. If the list doesn’t match what was actually signed, the signature is invalid, and the email is likely rejected or flagged as spam.

According to RFC 6376, the standard for DKIM, the h= tag must precisely reflect the headers used in the signature generation process. Deviations, even small ones like extra spaces, different capitalization, or missing colons, cause failures. This is why automated tools must verify the exact header list matches what was signed.

Testing this manually is unreliable. Use a tool that simulates the full verification process. With MailTester’s inbox placement tester, you can check how your DKIM signature—and every part of your email—holds up in a real delivery context.

How do email providers validate DKIM h= tag alignment?

When an email provider receives a message, it checks the DKIM-Signature header for the h= field, then verifies that each header listed actually exists in the message body in the exact order specified. If any header is missing, duplicated, or misspelled (like from instead of From), the check fails—even if the cryptographic signature is mathematically valid.

What the h= field actually does

The h= tag specifies which headers the sender claims are part of the signed message. Providers use this list to confirm the sender’s intent: they’re saying, “I signed these headers, and only these ones.” If a header like To or Date is included in h= but later modified by a server (like a mailing list), the alignment breaks.

Let’s say the DKIM-Signature header says h=From:To:Subject:Date;, but the actual message has From, Date, Subject, CC, and To. That’s a mismatch. The mail server throws the signature away. It doesn’t matter if the key is valid—it fails because the header order or presence doesn’t match.

Why alignment is so strict

Because DKIM is designed to prevent sender impersonation. If a malicious actor could omit a header like From from the signed list and replace it with a forged one, they could bypass checks. So providers enforce strict compliance: exact header names, exact case, exact order.

Even minor typos break alignment. from vs From is a common cause of failure. Some providers normalize case, but not all. The best practice is to match the case exactly as it appears in the message.

According to RFC 6376 (the core DKIM specification), the h= field must map directly to the headers present in the canonicalized message. A well-documented, open-source tool like IANA’s DKIM registry provides the official standard—no shortcuts allowed.

If you're sending bulk mail and want to catch header alignment issues before they hit the inbox, use real-time verification. MailTester’s email checker confirms header consistency and DKIM alignment during verification, so you don’t waste sends on addresses that will fail due to misconfigured signatures.

Common causes of DKIM h= tag misalignment

DKIM h= tag misalignment happens when the headers listed in the DKIM signature don’t match the actual headers present in the email at delivery. Even a single extra or missing header—like X-Original-From or List-Id—can break verification. This is especially common when sending platforms auto-inject headers, or when templates are reused without updating the signature. Always ensure the h= list reflects the final header set after all transit changes. For more on how DKIM works, see the DKIM specification.

Header changes during transit

  • You add or remove headers like X-Original-From, List-Id, or Precedence during routing or processing, but don’t update the DKIM h= tag accordingly.
  • Forwarding services or mailing lists often inject headers that weren’t in the original message. If the DKIM h= list doesn’t include them, validation fails.
  • Let’s say your email has a List-Id header added by your ESP after signing. The signature still lists only From and Subject—this is a mismatch.

Platform behavior and template issues

  • Using a sending platform (like Mailchimp or SendGrid) that auto-inserts tracking or delivery headers—such as List-Unsubscribe or Feedback-ID—without including them in the h= list.
  • Manually editing headers in an email client or tool (e.g., changing the subject line or adding a custom field) without re-signing the message with the updated h= list.
  • Reusing a template with pre-signed headers that don’t represent the current content. For example, a template signed with h=From:Subject may fail if the actual message contains a new X-Message-ID header that wasn’t included.
  • Some tools let you set h= values during setup, but if the actual message content changes (e.g., via merge tags), the h= list becomes stale—validation fails silently.

Even a missing or extra header can break DKIM. The signature is only as good as the header list it covers. Double-check your entire delivery chain.

If you're unsure whether your DKIM setup is aligned, test it with actual delivery results. Use inbox placement testing to see how your signed emails land in real inboxes—and whether DKIM verification passes.

What happens when DKIM h= tag alignment fails?

If the DKIM h= tag doesn’t match the actual header order and fields in your message, receiving servers reject the signature as invalid. This triggers spam filters at Google, Microsoft, and Amazon, which actively log and flag such failures. Even one misaligned header can result in delivery rejection, poor inbox placement, or messages being silently dropped without a bounce.

Reputable filters detect even small DKIM misalignments

Receiving servers like Gmail and Outlook don’t just check if a DKIM signature exists—they verify that each header listed in the h= tag actually appears in the message in the correct order. Any mismatch, even a single missing or reordered header, breaks the validation. This is enforced by industry-standard practices detailed in RFC 6376, which defines DKIM and specifies that header alignment must be strictly preserved.

Let’s say you sign your email with h=from:subject:date:to, but later the server reorders the Date header after To during delivery. The server will reject the signature. This happens more often than you'd think—even minor content changes or gateways rewriting headers can break alignment.

Repeated failures damage sender reputation and inbox placement

Each DKIM failure adds to the receiving server’s perception of your sending behavior. Gmail and Amazon SES track these signals over time. Consistent misalignment indicates poor email hygiene, which correlates with higher spam scores and lower trust. Once a sender reputation drops, even valid messages may land in spam or fail outright.

Without clear bounces, you’re left guessing why delivery fails. A message sent with correct SPF and DKIM but mismatched h= tags may disappear into spam folders unnoticed. This makes troubleshooting harder and wastes sending capacity.

Use your verification tools to catch this early. Test your email headers and DKIM alignment with inbox placement testing before sending at scale. With MailTester’s real-time API, you can validate that every header in the h= tag is present and in order—before it ever leaves your server.

How to test DKIM h= field list alignment in practice

You can verify DKIM h= tag alignment by sending real messages via MailTester’s inbox-placement test, inspecting the final headers, and confirming every listed header in h= appears exactly as written—same case, same order—in the message. Use the real-time API to automate this check and catch mismatches before sending to real inboxes.

Step-by-step verification process

  1. Send a test email through MailTester’s inbox-placement tool. This sends your message through real email providers (Gmail, Outlook, etc.) and returns full headers from the final receipt, not just what you sent.
  2. Locate the DKIM-Signature header. Find the raw DKIM-Signature line in the returned headers. Note the h= field value—this lists every header included in the signature.
  3. Review all headers in the message body. Check that each header listed in h= exists in the final message, is spelled identically (case-sensitive), and appears in the same sequence. Even a single missing or misordered header breaks verification.
  4. Check for preheaders, line breaks, and whitespace. Some tools strip headers or reformat them. The h= list must match exactly, including any custom or non-standard headers you’ve signed.
  5. Use the real-time API to simulate and validate. Integrate the MailTester API to send and validate messages programmatically. It returns structured feedback on header mismatches, including which header in h= is missing or misaligned.

Why order and case matter

DKIM verification is strict. The h= list is not a set—it’s a sequence. If the signing app lists From:To:Subject:, the receiving server expects that exact order in the headers. Swap To: and From: in your message, and validation will fail. This is documented in RFC 6376, Section 3.4, which defines the signature header format.

Even small header differences—like Content-Type vs content-type—will cause DKIM to fail. Exact match is required.

Use MailTester’s inbox placement test to simulate real-world deliverability. It shows you the end result, not just your draft—something most tools won’t do.

How MailTester helps ensure DKIM h= tag alignment

You don’t need to guess whether your DKIM h= tag list matches your actual email headers. MailTester sends real messages through Gmail, Outlook, and Yahoo, then returns the full received headers from the server—exactly as they were signed. If your h= field includes a header that doesn’t appear in the actual message, or omits one that’s present, we highlight the mismatch so you can fix it before sending at scale.

See exactly what was signed

When you run an inbox-placement test with MailTester, the message goes through the real delivery pipeline. Unlike simulators, we don’t guess what headers were included—we capture the full, raw headers from the receiving server. This allows you to see not just the DKIM signature, but every header that was present during delivery.

You’ll see the exact h= field value used in the signature. If it says h=From:To:Subject, but the actual message includes a Reply-To header that wasn’t listed, we flag that as a mismatch. This is how you catch the subtle errors that break DKIM validation when the receiving server checks alignment.

Fix before it breaks deliverability

DKIM verification failures due to header misalignment often lead to messages being marked as suspicious or rejected outright—especially by providers like Gmail, which enforce strict alignment rules.

MailTester’s inbox tests expose these issues before they impact sender reputation. You get a side-by-side comparison of expected headers (from your h= tag) and actual headers in the message, so you can adjust your signing configuration in tools like SendGrid, Mailchimp, or Klaviyo.

For teams using automation, our integrations with major platforms let you verify deliverability with every send. You’re not just checking addresses—you’re testing the full email stack, from DNS to delivery, with real-world visibility.

When you send with DKIM, alignment matters. And when your h= tag doesn’t match—reputation suffers. MailTester doesn’t assume. It shows you the truth.

A real-world example: DKIM failure due to header misalignment

DKIM verification fails when the h= tag field list doesn’t match the headers actually present in the final delivered message. Even if the signature is mathematically valid, Google and other receivers reject it if the signed headers don’t align with what was listed in h=. This mismatch causes legitimate emails to be flagged as spam, despite being properly signed.

The source of the misalignment

A client’s automated newsletter used a fixed DKIM header set: h=From:Subject:Date:. The template assumed only those headers would be present. But their email platform inserted two additional headers during delivery: X-Feedback-Loop and List-Id. These weren’t in the original h= list, but they were signed and present in the final message.

DKIM requires that every header in the message that’s part of the signature be explicitly listed in the h= tag. When a header is signed but not listed, the verification fails. The server still validates the cryptographic signature, but the header set mismatch triggers a rejection. This is standard behavior per RFC 6376, which defines how DKIM signing and verification work.

Why it failed even though the signature was valid

Mail servers like Google’s don’t just check if the signature matches — they verify that the listed headers in h= match exactly what’s in the message. If the final message has headers not in h=, the signature is considered invalid, even if the math checks out.

This client’s message passed basic technical validation but failed in inbox placement due to this header misalignment. The same message sent to a test address via MailTester’s inbox tester showed a DKIM failure, though the signature was intact. The issue wasn’t the key or algorithm — it was the missing header in h=.

Many modern email platforms automatically add headers for tracking, compliance, or routing. These are safe to include in the h= list as long as you’re accounting for them. The fix is simple: update your DKIM signing configuration to include all headers that may be added during delivery.

If your system prepends, modifies, or appends headers before sending, make sure your h= list reflects the final state of the message. Use your platform’s debug logs or inbox testing tools to audit what headers actually reach the recipient. You can check this directly with MailTester’s inbox placement tester to verify how your email appears in real mailboxes, including header alignment and DKIM status.

For developers managing DKIM signing, always review your final header set before signing. A small oversight here — like omitting List-Id — can trigger false negatives and hurt sender reputation. Proper header alignment is a foundational part of deliverability.

The role of SPF, DKIM, and DMARC in aligned header verification

SPF, DKIM, and DMARC work together to verify sender identity and message integrity. SPF checks if the sending IP is authorized, DKIM validates that headers and body haven’t been altered using a digital signature, and DMARC enforces policies based on SPF and DKIM results. Without alignment—especially in the DKIM h= tag field—the entire message can fail, even if SPF passes. This alignment is what inbox providers like Gmail and Outlook rely on to judge trustworthiness.

Why DKIM header alignment matters

DKIM uses the h= tag to specify which headers are included in the digital signature. If those header fields don’t match the actual headers in the message (e.g., From:, To:, Date:), the signature fails. This misalignment counts as a DKIM failure, and when DMARC is set to strict policy, it triggers a full DMARC failure—even if SPF is valid.

Let’s say you’ve set up SPF correctly, but your DKIM signature includes From and Subject in the h= list, while your message actually sends To: and Date:. The signature won’t verify, and the message will be rejected. This is why checking the alignment between the DKIM h= field and real headers is not optional—it’s required for inbox compliance.

How DMARC acts as the enforcement layer

DMARC doesn’t verify on its own. It relies on SPF and DKIM results. When configured with a strict policy, DMARC requires both SPF and DKIM to pass with proper alignment. If either fails, especially when DKIM alignment is off, the message is flagged.

Many senders assume SPF is enough. But inbox providers like the IETF’s DMARC specification (RFC 7073) make it clear: domain alignment across all three is needed to prevent abuse and abuse. Misconfigured DKIM h= tags are a common reason for legitimate emails bouncing.

Use tools that test alignment in real time. MailTester’s inbox placement testing simulates how real providers treat your messages, including header validation and DMARC alignment checks. It helps you catch configuration issues before sending to real users.

Best practices for maintaining DKIM h= tag alignment

DKIM h= tag field list must align with verified email headers to pass verification. If your signature includes specific headers in h=, but those headers are missing or altered in the final message, verification fails. Use a fixed header set, avoid dynamic changes, and test before sending to ensure alignment.

Build a consistent header baseline

  • Define a fixed, known list of headers used in every campaign before signing — typically From, To, Subject, Date, and Message-ID. Stick to this set.
  • Do not include optional headers like Reply-To or List-Id in h= unless they’re always present and unchanging across every send.
  • Use tools like RFC 6376 as reference for standard header usage and DKIM signing behavior.

Test and audit consistently

  • Use MailTester’s real-time API to test individual messages before sending. It checks header alignment and DKIM validity instantly.
  • Run inbox-placement tests via MailTester’s inbox tester before bulk sends. This reveals if your headers or DKIM setup are causing filters to block or tag messages.
  • When deliverability drops with no other apparent cause, audit inbound message logs. Look for header discrepancies — even if the sender IP and domain are clean, an altered header can break DKIM.
  • Use a single, consistent sending platform (e.g., SendGrid, Mailchimp, or a custom SMTP service) that doesn’t inject or modify headers after DKIM signing.
  • If you're using a third-party service with dynamic header insertion (like email tracking scripts), disable it or add it to the h= list only if it remains stable and unchanged.
DKIM alignment isn’t just about signing — it’s about control. If headers diverge between signing and delivery, even minor changes break verification.

Let’s make sure your DKIM setup stays predictable. A checklist like this isn’t theory — it’s how top deliverability teams maintain reliability across campaigns. Use MailTester to validate your header alignment across multiple providers, and verify your list’s integrity before sending.

DKIM verification should not be a one-time setup

DKIM validation relies on precise header alignment. Even minor changes in email templates, routing tools, or provider configurations can break this alignment. What verified last month may fail today due to added headers, rewritten formatting, or updated security policies.

Header fields like h= in a DKIM signature must match the exact sequence and structure of the headers sent in the final email. A mismatch—introduced during automated routing, ESP integration, or template updates—results in verification failure. This isn’t a risk you can ignore; it impacts inbox placement and sender reputation over time.

  • Automated checks via MailTester’s API or bulk list verification catch alignment issues before they cause sending failures.
  • Regular audits ensure consistent verification across campaigns, even as infrastructure evolves.
  • Unexpected delivery drops or sudden reputation penalties often trace back to unverified header changes.

Sources

Keep reading

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

What does the DKIM h= tag do?

The h= tag lists the email headers included in the DKIM signature calculation. Receivers validate that the actual message contains exactly those headers in the correct order.

Why did my email pass SPF but fail DKIM?

SPF only checks the sending IP. DKIM verifies the headers and body. A mismatch between the h= field and actual headers can cause DKIM failure even if SPF passes.

Can DKIM fail even if the signature is correct?

Yes. If the headers in the h= tag don’t match the actual headers in the message, the validation fails—even if the cryptographic signature is intact.

How do I fix a DKIM h= misalignment?

Update the h= tag to include all headers present in the final message, in the correct order. Test the corrected message using real delivery testing tools.

Does case matter in the DKIM h= tag?

Yes. Headers are case-sensitive. 'From' and 'from' are treated as different values, so alignment must match exact case.

Can a missing header cause DKIM failure?

Only if that header was listed in the h= tag. If the header is listed but missing, DKIM validation fails. If not listed, its absence doesn’t matter.

Do all email providers check DKIM h= alignment?

Yes—major providers like Gmail, Microsoft, and Yahoo enforce header alignment as part of DKIM validation to prevent forgery.

How often should I test DKIM header alignment?

Test every time you modify a template, add a new header, or switch sending platforms. Use automated testing tools for ongoing checks.

Can MailTester diagnose DKIM header mismatches?

Yes. MailTester’s inbox-placement tests return full headers from the receiving server and compare them against the DKIM h= field to expose alignment issues.

Is DKIM h= tag alignment required by all providers?

Yes. All major providers enforce DKIM header alignment as part of their authentication standards to ensure integrity and prevent spoofing.