DKIM h= tag missing | MailTester

Why is your DKIM h= tag missing for envelope-to header? A deep dive

You sent a message. It passed SPF. DKIM looked clean. Yet it landed in the spam folder—or worse, vanished with no bounce. Could a missing or misconfigured DKIM h= tag be the silent culprit?

The h= tag in your DKIM signature defines which headers are included in the cryptographic hash. When it omits the Envelope-To header—especially if your mail server or sending platform includes it in the signed list but doesn’t hash it correctly—the entire signature fails verification. This isn’t a minor detail. It’s a core failure point in email authentication.

Mail servers don’t just check if a signature exists—they check if every listed header was properly signed and verified in sequence. If Envelope-To appears in the h= list but the hash doesn’t match the actual header value, your message fails DMARC alignment. Not immediately blocked, but flagged. Over time, this erodes sender reputation, hurts deliverability, and reduces inbox placement—especially with major providers like Gmail and Outlook.

Key takeaways

DKIM h= tag must explicitly include the Envelope-To header if the sending system signs it, or the signature will fail validation.
Even if a message delivers, misconfigured h= tags can trigger spam filters and degrade sender reputation over time.
DMARC policies enforce alignment, and a mismatch in signed headers—like a missing or incorrectly hashed Envelope-To—results in failure even if SPF and DKIM pass individually.

What does 'envelope-to' actually mean in email authentication?

The envelope-to is the recipient address used in the SMTP RCPT TO command during email transmission — it's not the To: header in the email body. This field is invisible to end users but essential for routing, bounce handling, and authentication checks. Some providers require DKIM signatures to include envelope-to in the signed headers to validate message integrity.

Envelope-to vs. the To: header

You might think the To: header is the final word on who’s receiving the email, but it’s not. The To: header is part of the email’s content and can be modified or forged. The envelope-to is set during the SMTP handshake and never changes. It’s the actual address the mail server uses to route and deliver the message, and it's what’s checked when a bounce occurs.

Let's say you send an email to [email protected]. That address is included in the To: header, yes — but if the sending server uses multiple delivery paths or filters, the envelope recipient remains consistent. That’s why it's crucial for tracking where a message actually went and whether it bounced.

Why envelope-to matters in DKIM

DKIM signatures verify that the email content hasn’t been altered since it was signed. The h= tag in DKIM specifies which headers are signed. If the envelope-to header is part of that list and missing from the signature, the check fails — even if the body and other headers are valid.

Some providers — including major ISPs and email security gateways — now require envelope-to to be included in signed headers to ensure end-to-end integrity. Without it, authentication can fail, and your message might be marked as suspicious or rejected.

According to RFC 6376, which defines DKIM, the list of signed headers is meant to cover all fields involved in message routing and delivery. While this doesn't mandate envelope-to as a required header, many providers implement it as a compliance standard.

If you're troubleshooting deliverability, check that your DKIM setup includes the envelope-to header in the h= tag — especially if you're using third-party email services or bulk senders.

Use a full email verification service like our email checker to catch invalid addresses and alignment issues before they cause delivery problems. This includes checking for common authentication flaws that could result in an incomplete DKIM signature.

How DKIM header signing works: a technical walkthrough

DKIM signs only the headers listed in its h= tag, which defines the exact headers the sender agrees to authenticate. If Envelope-To is included in that list, it must be present in the email’s header block and correctly formatted. The signing process creates a hash of those headers in order, and the receiving server verifies that the hash it computes matches the one in the DKIM signature. If not, the signature fails. This process ensures header integrity but also means any missing or malformed header in the h= list breaks authentication.

How the DKIM signing process works step by step

Identify headers to sign using the h= tag in the DKIM-Signature header. For example, h=From:To:Subject; means only those three headers will be included in the signature. If Envelope-To appears here, it must be present in the message.
Normalize the header block before hashing. DKIM requires all headers to be lowercased, spaces between key and value reduced to one, and line endings converted to CRLF. This ensures consistency across systems.
Order and concatenate selected headers exactly as they appear in the message, preserving the order in which the mail server received them. The hash is computed on this string, including the colon and value but no line breaks.
Apply the private key to the hash using RSA or ECDSA. The resulting signature is inserted into the DKIM-Signature header using the s= and b= fields.
Receiving server checks the h= list, locates each listed header in the incoming message, normalizes them, and computes the same hash. It then verifies the signature using the sender’s public key, retrieved via DNS lookup.
If any expected header is missing (like Envelope-To when listed in h=), the hash cannot match. The receiving server rejects the signature, which can lead to the email being marked as unauthenticated or spam.

Common pitfalls and how to fix them

One of the most frequent errors is listing Envelope-To in the h= tag without actually including it in the header block. This often happens in automated mail servers that omit envelope headers during signing.

The 6 steps described in “How the DKIM signing process works step by step”, in order.

Another issue arises from inconsistent header formatting. Even a single extra space, misplaced colon, or mixed case can alter the hash. The RFC 6376 specification details these rules, but even small deviations cause failures.

Use tools like MailTester’s email checker to validate your signed emails before sending. It checks DKIM, SPF, and DMARC in real time and flags missing or malformed headers in the h= list.

DKIM is not a guarantee of message integrity—only of the headers it explicitly signs. If a header in the h= list is missing or misformatted, the signature fails. This isn’t a flaw in DKIM; it’s a feature designed to catch tampering.

Always verify your DKIM setup with a real email test. Tools that simulate inbox placement—including MailTester’s inbox placement tool—can confirm if your signature passes at scale.

Common causes of missing h= tag for envelope-to

You’re missing the h= tag for envelope-to in your DKIM signature because your signing tool skips it by default, you’re manually generating signatures without including all headers, or your DKIM DNS record uses outdated or incomplete documentation. These missteps break alignment and hurt deliverability. Fixing them means checking your tools, signing process, and DNS settings.

Signing tools that exclude envelope-to by default

Many default DKIM signing tools (like older versions of OpenDKIM or mail transfer agents) omit the envelope-to header unless explicitly instructed.
Let’s say you’re using a legacy email relay—check its configuration. It might skip envelope-to unless the h= tag includes it in the list.
For accurate alignment, ensure your tool’s signing policy explicitly includes envelope-to in the header list.

Manual signature generation without full header reference

When you craft a DKIM signature by hand (e.g., via a script or CLI), it’s easy to forget headers like envelope-to if the reference isn’t complete.
The RFC 6376 specifies that the h= tag must list all headers used in the signature—omitting envelope-to breaks alignment checks.
If you’re signing messages manually, double-check your header list against the full RFC specification.

Outdated or incomplete DNS records

Some outdated DKIM DNS records (especially those from early email service providers) use incomplete or deprecated syntax, leaving out essential fields like envelope-to.
Check your published DKIM record. If it doesn’t explicitly include envelope-to in the h= tag, even with correct key data, alignment will fail.
Use MxToolbox to validate your DKIM record—this tool checks both format and header alignment.

Even if your DKIM signature has the right key and signature value, missing envelope-to in the h= tag breaks authentication alignment. This increases the chance of your emails being marked as spam, particularly in strict filtering environments. Use a tool like MailTester’s email checker to spot invalid or misaligned addresses before sending—especially when debugging delivery issues.

Impact of an incomplete DKIM h= list on deliverability

Missing the envelope-to header in the DKIM h= tag can cause DKIM verification to fail, even if all other headers are signed correctly. Since DMARC checks alignment against the envelope-from and header-from domains, an incomplete h= list risks misalignment, leading to rejection or quarantine—especially under strict DMARC policies. This failure reduces sender reputation and increases spam scoring across multiple email systems.

Why envelope-to matters in DKIM alignment

DKIM uses the h= tag to list which headers are included in the signature. If Envelope-To isn’t listed, the validator can’t confirm it was signed, even if it’s present in the message. This breaks the integrity of the signature chain, causing verification to fail.

When receiving servers verify DKIM, they expect all headers referenced in h= to be signed. Omitting Envelope-To, even if it’s not used in recipient display, can still break alignment enforcement—particularly under DMARC policies that require strict header alignment.

How failures cascade into deliverability issues

One failed DKIM signature might not stop a message immediately, but repeated failures across messages signal poor sender hygiene. Mail receivers tracking reputation—like Microsoft’s SmartNetwork Filtering or Google’s Postmaster Tools—use these patterns to adjust inbox placement.

High failure rates on key headers like Envelope-To can cause your domain to be flagged as inconsistent or risky. Even a single misconfigured message can feed into broader scoring models that use authentication consistency as a red flag.

Some providers, including those that follow standards like RFC 6376, specify that Envelope-To should be included in h= if it’s present in the message. While not universally enforced, its absence increases risk when policies are strict.

Let’s say you send emails with signed headers but skip Envelope-To in the h= list. Even if your SPF and DKIM pass, the alignment checks in DMARC may still fail. If your policy is reject, the message won’t reach the inbox at all.

Preventing this doesn’t require complex changes. Just ensure your signing mechanism includes Envelope-To in the h= list when the header exists. Tools like MailTester’s email checker can test individual addresses and validate basic authentication setup before sending.

For larger-scale checks, use the bulk email verification tool to catch alignment issues in high-volume campaigns. It flags malformed DKIM signatures and helps avoid delivery problems caused by subtle configuration errors.

How to validate your DKIM h= list using real tools

You can validate your DKIM h= tag configuration by checking your public DNS records with tools like MxToolbox or Spamhaus, inspecting raw email headers to see if envelope-to is signed, and testing deliverability in real inbox conditions using MailTester’s inbox-placement test. These steps confirm whether your DKIM signature includes the envelope-to header and is properly aligned.

Check your DKIM DNS record using MxToolbox or Spamhaus
Enter your domain and selector into MxToolbox’s DKIM lookup tool or Spamhaus’s email validation service. These tools display the raw DKIM TXT record, including the exact h= tag list. If envelope-to is missing from the list, your signature won’t cover the envelope recipient, risking authentication failures.
Inspect raw email headers to confirm envelope-to inclusion
Open an email sent from your domain in Gmail, click "Show original," and search for the DKIM-Signature header. Look for the h= tag and verify that envelope-to appears in the list of signed headers. If it doesn't, receiving servers may reject the message despite valid DKIM.
Simulate real-world inbox placement with MailTester’s inbox tester
Use MailTester’s inbox-placement test to send a message to multiple real email providers. The test returns detailed feedback on authentication results, including whether the DKIM h= tag list is sufficient. For example, some providers like Yahoo or AOL strictly require envelope-to in the h= list.
Review RFC 6376 for alignment rules
DKIM’s RFC 6376 states that the h= tag must include all headers used in verification. While envelope-to is not required for all domains, its absence can cause failures on strict receivers. If you use sender policies or bounces for validation, it’s critical to include it.

Why missing envelope-to matters

Some mail servers check the h= list during authentication. If the envelope-to header is not signed, and the receiving server enforces strict alignment, the message may be flagged as suspicious—even if the body and From header pass. This leads to undelivered emails, poor sender reputation, and higher spam scores.

Proactive validation with MailTester

Instead of guessing whether your configuration works, use MailTester’s inbox-placement testing to see how your emails behave across major inboxes. The report includes DKIM validation details, SPF/DKIM alignment, and real-time feedback on header signatures. You can test the exact same messages your system sends, with no setup required.

For teams using large lists, MailTester’s bulk verification checks every address for deliverability risks, including missing or misconfigured DKIM headers. It’s the closest you can get to testing in production without sending.

Verifying DKIM alignment with MailTester’s real-time API

Use MailTester’s real-time API to validate DKIM signatures and check for missing or incorrect h= tags in the envelope-to header during email authentication. It detects structural issues in the DKIM alignment chain before you send at scale, reducing bounces and improving inbox placement.

How DKIM alignment impacts deliverability

DKIM alignment ensures the domain in the From: header matches the domain used to sign the message. A missing or incorrect h= tag in the DKIM signature can break this alignment, even if the public key is valid. This issue often leads to rejection by receiving mail servers, especially in high-security environments like enterprise or financial domains.

The h= tag specifies which headers are included in the DKIM signature. If the Envelope-To header (a non-standard header used to track delivery path) is referenced in the signature but not included in the h= list, the validation fails. MailTester’s API checks for this exact mismatch, flagging it in the verdict.

Proactively fix alignment issues before sending

Let’s say you’re sending transactional emails and notice a spike in hard bounces. You suspect authentication issues. With MailTester’s real-time API, you can batch-check your list and surface addresses where DKIM alignment fails due to missing h= tags. The response includes structured feedback: dkim_alignment: failed, with a reason like missing h= tag for Envelope-To in signature.

By fixing these issues upfront—adjusting your signing configuration to either exclude or properly include the Envelope-To header—you avoid sending messages that will be flagged as suspicious. This aligns with industry standards; RFC 6376 (the DKIM specification) explicitly requires all signed headers to be listed in h=. You can verify this in the official specification at tools.ietf.org/html/rfc6376.

Integrate the API into your send workflow and run checks on addresses just before delivery. This catches alignment gaps before they become deliverability problems. For teams using SendGrid, Mailchimp, or HubSpot, the MailTester integrations streamline this step within existing tools.

Fixing DKIM h= tag issues step by step

When your DKIM signature is missing the h= tag for the Envelope-To header, receiving servers may reject your message or mark it as unaligned. This breaks DMARC alignment and harms deliverability. Fix it by ensuring your mail server signs the correct headers — including Envelope-To — and re-signing messages accordingly. Verify the fix by testing inbox placement with a tool like MailTester.

Check what headers are signed

Log into your outbound mail server’s configuration (like Postfix, Exim, or SendGrid’s SMTP settings) and review the DKIM signing rules. Not all servers sign the Envelope-To header by default — it's often omitted. You can check this in the DKIM signature header itself, which appears as DKIM-Signature: v=1; a=rsa-sha256; d=yourdomain.com; h=from:to:subject:date:sender; s=brisbane;. If Envelope-To isn’t listed, you’ve found the issue.

Update your signing configuration

Let’s walk through the fix step by step:

Review your DKIM policy: Confirm whether your domain’s DMARC policy or receiving servers expect Envelope-To to be signed. While not required by RFC 6376, many large providers (like Google, Microsoft) enforce stricter alignment rules. This is often necessary to pass DMARC alignment=relaxed or strict checks.
Add Envelope-To to the h= list: Edit your DKIM signing configuration to include Envelope-To in the list of signed headers. For example: h=from:to:subject:date:sender:Envelope-To;. You can find guidance in the DKIM specification (RFC 6376), which outlines header selection.
Re-sign outbound messages: After changing the header list, send a test message. Confirm that the new DKIM signature now includes Envelope-To in the h= tag.
Validate the signature: Use a tool like Mail-Tester or your DMARC analyzer to check the full DKIM signature. Ensure the Envelope-To header appears and that the hash aligns with the message body and headers.

Test for inbox placement success

Even if the signature is technically correct, it might still fail delivery due to receiver policies. Use MailTester’s inbox-placement test to send a message to multiple major mail providers (Gmail, Outlook, Yahoo) and see where it lands — inbox, spam, or blocked. A clean test result means the DKIM alignment now passes DMARC checks and deliverability has improved.

Fixing the h= tag issue may seem technical, but it’s one of the most effective ways to boost inbox placement for high-volume senders. Once the configuration is correct, re-test regularly — especially after server updates.

Why checking DKIM alignment matters more than accuracy

You can have a perfectly valid email address with no syntax errors or deliverability red flags, but if DKIM alignment fails—especially with the h= tag missing in the envelope-to header—your message still risks being blocked, quarantined, or marked as spam. Authentication isn’t just about whether the address exists; it’s about proving you’re authorized to send from that domain. A single misalignment can tank inbox placement, even if your bounce rate is under 1%.

Authentication failures slip past address validation

Standard email verification tools confirm syntax, domain existence, and mailbox responsiveness—but they don’t check cryptographic alignment. A single address might pass every validation check yet fail DKIM if the h= tag for envelope-to is missing or mismatched. This isn’t a rare edge case; it’s a common pitfall when mail servers enforce strict alignment policies.

Even a 0.5% bounce rate—seemingly negligible—can trigger scrutiny from receiving servers. Spam filters and filtering systems don’t just count bounces; they analyze patterns. Consistently missing h= tags in DKIM headers signal poor sender hygiene, leading to increased spam filtering or rejection on the receiving end. It’s less about the absolute number and more about the pattern of failure.

Alignment preserves sender reputation over time

DKIM alignment isn’t optional—it’s essential for maintaining sender reputation. When you send mail, receiving servers check if the domain in the From: header aligns with the domain used in DKIM signature. If envelope-to is missing from the h= tag or misaligned, the signature fails, even if the key is valid. This breaks SPF/DKIM/DMARC alignment, causing rejection or spam labeling.

Over time, repeated misaligned authentication leads to progressive degradation in sender reputation. ISPs and email providers track alignment trends. A consistent track record of proper authentication builds trust—but one misaligned tag can erode it fast. This is why proactive checking matters more than just validating address formats.

Using a tool like MailTester’s bulk verification ensures not just address validity, but alignment integrity across your entire list. It checks for header-level issues—including missing h= tags in DKIM—for every email, catching problems before they harm deliverability. This is the real difference between a "valid" address and a "deliverable" one.

For deeper insight, refer to the DKIM specification (RFC 6376), which defines how headers like h= should be structured for proper cryptographic verification. Misaligned headers may meet basic syntax rules but still fail at the real-world filtering layer.

You don’t need to manually check every email’s DKIM alignment or guess if an envelope-to header is misconfigured—MailTester’s bulk verification scans your list for technical delivery risks, including missing or mismatched DKIM h= tags, catch-all accounts, and weak sender reputation. It flags these issues before you send, helping you avoid bounces and inbox placement drops with 98.9% accuracy.

Real-time insights for senders using major platforms

Let’s say you’re sending via SendGrid, Mailchimp, Klaviyo, or HubSpot. Each of those systems relies on correct headers, SPF, DKIM, and DMARC to pass authentication. A missing or incorrect DKIM h= tag for the envelope-to header can break alignment, leading to rejection—even if the address is valid. MailTester’s real-time API checks both address validity and technical setup in under a second, so you can scrub the list and fix errors before the first message goes out.

For example, if your sender domain uses a specific envelope-to header but the DKIM signature doesn’t include h=tag matching that header, the receiving server may reject the email. This is a known source of delivery failures—RFC 6376 (the DKIM standard) clearly specifies the need for alignment between the DKIM signature's h= tags and the headers being signed. A tool like MailTester ensures that alignment is correct by detecting such mismatches during verification.

Check your list quality before it hits the inbox

With MailTester’s bulk verification, you’re not just checking if an address exists—you’re validating deliverability readiness. The tool identifies invalid emails, catch-all addresses, role accounts, disposable domains, and technical flaws like incorrect DKIM headers. All of this is done at scale, and results are returned fast.

Use the bulk email verification tool for high-volume sends. If you’re integrating verification into your workflow, connect your system with our real-time API—designed to work alongside SendGrid, Mailchimp, Klaviyo, and HubSpot. It’s not just about validity. It’s about ensuring your messages pass authentication checks before they’re ever sent.

For a final check, test your actual message’s inbox placement with our inbox placement tool. This reveals what your email will look like in actual inboxes across providers—exposing delivery issues that aren’t apparent from headers alone.

The bottom line: authentication isn't optional — it's mandatory

Missing the dkim h= tag for the envelope-to header isn’t a minor quirk. It’s a common and critical flaw in email authentication that can trigger rejection by modern mail servers.

Even small misconfigurations—like omitting required header fields in DKIM signatures—degrade sender reputation. This directly impacts inbox placement, especially for bulk or transactional sends.

Validate your setup before sending. Use MailTester to test your DKIM configuration, catch headers, and verify deliverability in real-world conditions.

Sources

At regional mailbox providers, 15.5% of email goes missing without a trace versus only 2.8% filtered to spam — the inverse of the pattern at Gmail, Microsoft, Yahoo, and Apple. — Validity 2025 Email Deliverability Benchmark Report (2025)
Benchmark testing of 15 major email service providers found about 10.5% of legitimate emails land in the spam folder and a further 6.4% go undelivered. — EmailTooltester deliverability benchmark (via WarmForge) (2026)

Keep reading

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

What happens if the DKIM h= tag doesn't include envelope-to?

The DKIM signature may fail verification if the receiving server expects it. This can trigger DMARC rejection, reduce inbox placement, and harm sender reputation.

Can DKIM work without signing the envelope-to header?

Yes, but only if the receiving server does not require it. Many modern systems do include envelope-to in validation, especially for DMARC alignment.

How do I know if my DKIM record includes envelope-to?

Check your DNS TXT record for the DKIM selector. It will list signed headers in the h= tag. If envelope-to is missing, you need to update the signing configuration.

Does MailTester test DKIM header alignment?

Yes. MailTester’s deliverability test includes DKIM verification and reports structural issues like missing or misconfigured headers.

Why does envelope-to matter if it’s not visible?

It's used in routing, bounce handling, and authentication checks. Receiving servers use it to validate message flow and alignment.

Can a missing h= tag cause permanent blocking?

Not immediately, but repeated failures due to misalignment can lead to temporary or permanent blocks by spam filters or domain policies.

Is DKIM h= tag configuration different for every domain?

Yes. The required headers depend on the recipient’s DMARC policy and their server’s validation rules. Some domains require envelope-to; others don’t.

Can I automate DKIM signature validation?

Yes. MailTester’s API allows automated validation of individual addresses and bulk lists, including header alignment and authentication status.

Does MailTester detect all types of DKIM misconfigurations?

It identifies key issues like missing h= tags, incorrect selectors, and malformed signatures, with 98.9% accuracy across verified domains.

Do I need to fix DKIM even if I'm not getting bounces?

Yes. A lack of bounces doesn’t mean your message is passing all authentication checks. Poor alignment can still result in low inbox placement or spam filtering.

Can role accounts affect DKIM verification?

No. Role accounts (like admin@ or sales@) are not inherently tied to DKIM misconfiguration. But they can be flagged if they receive messages with flawed authentication.

Are disposable domains affected by DKIM issues?

Yes. Disposable domains often fail authentication. MailTester detects these and flags them during bulk verification.