Detect z= Tag & Header Mismatch

What is a z= tag mismatch, and why does it break email deliverability?

You sent a perfectly crafted email. It passed spam checks. The content is on-brand. Yet it lands in the bulk folder—or worse, gets rejected. Why? One invisible culprit: a z= tag mismatch in your DKIM signature.

This happens when the email’s header canonicalization method during signing doesn’t align with how the receiving server processes it. Even a small mismatch can trigger rejection by Gmail, Yahoo, or Microsoft, despite all other elements being correct.

The z= tag in DKIM is a signal: it shows which canonicalization method was used. If the receiving server expects relaxed and the sender sent strict—boom—the DKIM check fails silently. No bounce message. No clear alert. Just delivery failure.

Key takeaways

A z= tag in DKIM logs the canonicalization method used for headers during signing.
DKIM verification fails when the receiving server applies a different canonicalization than the one indicated by the z= tag.
Even valid emails can be blocked if header canonicalization differs between signing and receiving servers.

How do header canonicalization and z= tags affect sender reputation?

DKIM failures from header canonicalization mismatches or z= tag issues are reported in DMARC reports and treated as authentication errors by major providers like Gmail and Yahoo. Even a single unresolved mismatch can signal poor sending hygiene, which negatively impacts sender reputation over time — especially when repeated across emails. Reputation systems don’t just track user complaints; they flag technical inconsistencies like these as red flags.

Why DKIM fails when headers don’t match

When a sender’s email server signs the message with DKIM, it applies specific rules to normalize headers — known as header canonicalization. If the receiving server applies a different canonicalization rule (or if a z= tag is added post-signature), the signature won’t verify, even if the email content is unchanged. This mismatch appears in DMARC reports as a DKIM failure, which providers use to judge legitimacy.

For example, Gmail and Yahoo enforce DMARC policies strictly. If your domain consistently shows DKIM failures due to canonicalization differences, your inbox placement drops — even if no one marked your email as spam. These systems treat authentication anomalies as indicators of potentially compromised or poorly configured sending infrastructure.

z= tags aren’t just metadata; they’re a reputation signal

The z= tag in DKIM signatures adds a checksum of the header structure. If the receiving server sees a mismatch — because the header was modified after signing, or because of canonicalization differences — the signature is invalid. This is why a single email sent with a malformed z= tag can signal broader technical instability across your domain.

Reputation engines, including those used by Mailbox Providers (MBPs), track not just whether an email passes authentication, but also how consistently it does so. One failure might be overlooked. Thirty in a week? That’s a red flag. Tools like MailTester’s email checker can test whether an address is valid and whether its DMARC configuration is aligned, helping you catch issues before they hit the inbox.

Authentication is not a binary — it’s a system of checks. Every failed DKIM due to header canonicalization or z= mismatch adds weight to reputation calculations. The same systems that scan content for spam also analyze technical execution. That’s why even small errors can have outsized effects.

For deeper insight, refer to the DKIM RFC (6376), which defines how signing and header normalization should work. If your process diverges even slightly, the failure shows.

What email authentication tool detects z= tag and header canonicalization mismatch?

No public email authentication tool currently offers real-time detection of z= tag and header canonicalization mismatches in outbound messages. However, MailTester’s deep SMTP-level validation during email verification can surface anomalies in DKIM signing behavior that hint at such issues. It checks domain records, DNS alignment, and canonicalization paths in real time, offering structured feedback on DKIM signature structure—including whether a z= tag is present and how headers were processed during signing.

Why z= tag and canonicalization matter

DKIM signatures rely on precise header canonicalization—the consistent formatting and ordering of headers during signing. When the actual headers sent don’t match the ones signed, even minor differences can break authentication. The z= tag specifically lists which headers were included in the signature. If the tag is missing or the selected headers don’t align with the actual headers sent, the signature fails validation even if the key is correct.

This mismatch often arises from header manipulation or inconsistent signing logic across systems. While tools like Spamhaus and the IETF RFC 6376 (which defines DKIM) document expected behavior, no widely used SaaS tool exposes this data directly during email sending or verification in real time. You’ll find diagnostic details in logs, but not as a structured, actionable report in most tools.

How MailTester uncovers these issues

When you use MailTester’s real-time verification API, it doesn’t just say “valid” or “invalid”—it simulates a full delivery path and validates each step of the authentication chain. It checks SPF, DKIM, and DMARC alignment, including how headers were canonicalized before signing.

During this process, the API flags whether a z= tag is present in the DKIM signature and compares it to the actual headers sent. If the z= tag lists specific headers but those headers were altered or reordered during transit, the tool can detect the inconsistency. You get a detailed report—not just a pass/fail verdict—but a breakdown of how the signature was constructed, including canonicalization path and header selection.

For teams validating outbound campaigns, this level of insight is critical. You can’t fix what you can’t see. Tools that only return basic validity checkmarks miss these subtle, real-world breakdowns that hurt deliverability. MailTester’s approach—testing authentication end-to-end, not just parsing DNS records—gives you the visibility you need.

Try it yourself: test how your DKIM signature holds up under real-world conditions with our email checker or integrate deep validation into your workflow using our verification API.

How MailTester identifies z= tag and canonicalization issues during verification

You can trust MailTester to catch DKIM signature mismatches tied to header canonicalization by simulating real-world delivery conditions. During inbox-placement testing, we process each email exactly as a receiving server would—applying the same header and body canonicalization rules. If the z= tag in a DKIM signature claims relaxed canonicalization but the server applies strict, we log it as a technical mismatch. This visibility prevents delivery failures caused by subtle protocol deviations.

Process: How MailTester detects z= tag discrepancies

Simulate the full delivery path — When running inbox-placement tests, MailTester routes each email through a realistic SMTP pipeline, mimicking how receiving servers process and validate DKIM signatures.
Record the server’s canonicalization method — We track whether the receiving server applied relaxed or strict header canonicalization, based on actual response behavior during delivery simulation.
Parse the z= tag in the DKIM signature — The z= tag explicitly states the canonicalization method used when signing the email (e.g., z=header=relaxed or z=body=relaxed).
Compare z= tag with server behavior — We verify if the z= tag matches the server’s actual canonicalization method. A mismatch—such as relaxed in the tag but strict processing—triggers a diagnostic flag.
Report the issue in deliverability diagnostics — These discrepancies appear directly in the verification report under the DKIM and deliverability sections, helping you diagnose why certain emails might be rejected or marked as suspicious.

Why this matters in real-world deliverability

Even small differences in canonicalization can cause DKIM failures. RFC 6376, the standard for DKIM, defines both relaxed and strict methods for handling whitespace and header ordering. While many servers default to relaxed, some apply strict rules—especially in high-security environments. A mismatch between the z= tag and actual server behavior means the signature is technically invalid, leading to rejection or spam filtering.

The 5 steps described in “Process: How MailTester detects z= tag discrepancies”, in order.

You can test this at scale using our inbox placement tester. It checks your messages against live mail providers, exposing issues like this before they impact deliverability. If you're using MailTester’s bulk verification or verification API, you’ll get the same level of diagnostic depth without needing to send.

For a deeper dive into how DKIM works—and why header canonicalization is critical—see the official DKIM specification. The same standard that defines the z= tag also sets the rules around whether relaxation or strictness is expected.

Why standard email verifiers miss z= tag and header canonicalization issues

You’re using a standard email verifier, but it’s not catching DKIM signature mismatches caused by z= tag misalignment or header canonicalization errors. That’s because most tools only check if an email address bounces or responds — they don’t inspect the full DKIM signature structure or simulate real SMTP delivery. As a result, technical misconfigurations go undetected until you suffer delivery failures or inbox placement drops.

Most tools don’t validate DKIM at the protocol level

Traditional email verifiers treat an address as “valid” if it accepts mail or doesn’t immediately bounce. They don’t connect to the mail server, parse the SMTP session, or validate how headers were processed during message signing. You might get a green light on an address, but if the z= tag in the DKIM signature doesn’t align with the canonicalized headers, the email will fail authentication on delivery.

Digital signatures like DKIM rely on strict header canonicalization — a process defined in RFC 6376. When a signing server and a receiving server apply different rules for folding, spacing, or ordering headers, the canonicalization differs. The z= tag in a DKIM signature must reflect the exact header set used at signing. If it doesn’t, and the tools don’t check this, you’re sending messages with broken authentication.

Only full SMTP simulation reveals real-world delivery risks

Without simulating an actual SMTP transaction, you can’t observe how headers are processed before signing or verify whether the z= tag matches the final header set. This gap means you may never know your messages are failing SPF/DKIM alignment until they hit the inbox — or worse, get blocked entirely.

That’s why tools that only perform basic syntax or syntax-like checks miss the real culprits behind delivery failures. The best way to catch these issues is to test with real SMTP behavior, including DKIM signature validation and header alignment. MailTester’s inbox placement testing simulates actual delivery and checks for canonicalization mismatches and z= tag alignment in real time — not just on static checks.

Standard verifiers won’t catch this. You need a deeper check.

How to fix z= tag and header canonicalization mismatches detected by MailTester

You’re seeing a z= tag mismatch in MailTester’s verification report because your DKIM signature uses one canonicalization method (like relaxed) while the receiving server expects another. To fix it, examine your email’s raw header to find the z= tag value, confirm your ESP’s signing settings match that method, adjust the configuration if needed, and retest with MailTester’s inbox-placement tool to verify the fix.

Check and align your DKIM canonicalization settings

Inspect the raw email header to locate the DKIM signature and find the z= tag. It will specify header=relaxed or header=strict. This is the exact canonicalization method your email claims to use.
Review your email service provider’s DKIM signing settings. Some providers default to relaxed header canonicalization, while others use strict. The setting must exactly match the z= value in the signature. A mismatch breaks DKIM validation.
Update the signing configuration if the settings don’t align. For example, if your signature says z=header=relaxed but your ESP applies strict canonicalization, switch it to relaxed. This alignment is required for receiving servers to validate DKIM.
Test the fix with a real inbox simulation. Use MailTester’s inbox-placement test to send a sample email through real mail servers. This confirms the mismatch is resolved and your delivery won’t be blocked or marked as spam.

Why canonicalization matters

Canonicalization affects how email headers are normalized before hashing. If the signing side and receiving side apply different rules, even a small change — like extra whitespace or order — will invalidate DKIM. The z= tag documents the exact method used, so it must be respected.

Industry standards like RFC 6376 detail how DKIM works, including canonicalization rules. When configured correctly, it ensures authenticity across complex delivery paths. Misalignment is a common cause of failed DKIM checks, especially with third-party ESPs that apply default settings.

Before sending to your list, test the corrected setup. MailTester’s inbox-placement feature includes checks for DKIM, SPF, and DMARC — it simulates delivery to Gmail, Yahoo, and Outlook. If the z= tag is properly aligned, the test will pass, confirming your email will reach inboxes.

What other technical email issues does MailTester catch during verification?

You’re not just checking if an email exists—you’re validating whether it’s technically sound and trusted by the receiving infrastructure. MailTester goes beyond basic syntax by catching misconfigured SPF, DKIM, and DMARC setups that cause bounces or spam flags. It flags malformed or expired DKIM signatures, alignment issues in DMARC policies, and high-risk address types that hurt deliverability—even before you send.

Authentication flaws that break delivery

Invalid or overly permissive SPF records, which can trigger rejection by receivers checking domain authorization. SPF is a foundational check—your sender domain must be properly configured to avoid being blocked.
DKIM signatures with expired or malformed cryptographic keys, breaking the chain of trust. These fail during verification even if the address is valid.
Misaligned DMARC policies—where the "p" (policy) setting doesn’t match the actual sender or domain alignment. This often prevents legitimate emails from passing authentication checks. See the IETF RFC 7483 for the full specification on DMARC enforcement.

High-risk address types and delivery red flags

Role-based addresses like admin@, support@, or contact@, which have lower engagement and higher bounce rates due to automated filters. These are often flagged as potentially risky by modern email systems.
Disposable email addresses (e.g., tempmail.org domains), known for short lifespans and low deliverability. MailTester uses known patterns and reputation data to flag these early.
Catch-all email configurations that accept any address, commonly abused by spammers. These can signal poor list hygiene and reduce sender reputation over time.

These checks happen automatically during real-time or bulk verification. You’re not just cleaning your list—you’re validating whether the recipient infrastructure will accept your message at all. For a high-impact setup, run your list through our bulk verification or use our real-time verification API to integrate checks directly into your onboarding flow. Deliverability starts before the first send—when the email address is still just a string in your database.

How MailTester improves deliverability via real-time authentication checks

You can detect z= tag and header canonicalization mismatches—and other subtle misalignments—by simulating the full email delivery path with real-time SMTP validation and DNS checks. MailTester doesn’t just test email syntax; it validates the entire authentication chain, from DNS records to header structure, using live, protocol-level checks that mirror how inbox providers actually evaluate messages.

SMTP-level validation catches delivery path issues early

Every address is tested through a real SMTP session, just like an email server would. This reveals issues that static checks miss—such as greylisting, temporary delivery failures, or server-level rejections—before your campaign sends. You aren’t just checking if an address exists; you’re verifying if it can actually receive mail.

Real-time DNS and header analysis expose deep technical flaws

MailTester checks SPF, DKIM, and DMARC records in real time, confirming they’re published and properly aligned. It also analyzes the full email structure—including header canonicalization—to catch mismatches that can trigger spam filters. For example, some servers expect headers to be canonicalized in a specific way, and discrepancies in the z= tag or header field order can cause DMARC failures even when DNS says everything is set up correctly. This level of scrutiny is standard in industry best practices, as outlined in RFC 6376 (DKIM) and RFC 7052 (DMARC alignment).

Because these checks simulate actual delivery conditions, MailTester returns a 98.9% accurate verdict on each address. It doesn’t guess—it confirms. Addresses flagged as "risky" or "catch-all" are highlighted so you can decide whether to send to them, reducing bounce rates and protecting sender reputation.

Use the bulk email verification tool to check thousands of addresses at once, or integrate the real-time verification API into your onboarding workflow. For final testing before campaign launch, run an inbox placement test to see how your message lands across major providers.

Integrating MailTester to catch z= tag issues before sending campaigns

You can catch z= tag and header canonicalization mismatches early by integrating MailTester with your ESP—Mailchimp, HubSpot, Klaviyo, or SendGrid—then running bulk verifications before campaigns. This stops invalid or improperly authenticated addresses from reaching inboxes, reducing bounces and improving sender reputation. You’ll find issues like mismatched header canonicalization that break SPF/DKIM alignment, which are invisible until they trigger filters.

Set up automated verification across your workflow

Connect MailTester to your ESP using native integrations. This syncs your subscriber list with MailTester’s engine before any send, catching invalid, catch-all, or misconfigured addresses early. No need to export or re-import. See supported tools here.
Run bulk verification on your lists before campaigns. MailTester checks each address for validity, delivery risk, and authentication health—including alignment issues caused by z= tags or header canonicalization mismatches. A 98.9% accuracy rate means fewer false positives and real-time signal clarity.
Use the real-time API during onboarding or uploads. Embed the Email Verification API into your sign-up forms or CRM syncs. It evaluates each address instantly—flagging mismatches in SPF/DKIM alignment before they hurt deliverability.
Review deliverability diagnostics post-verification. MailTester reports highlight issues like malformed headers, catch-all detection, and canonicalization problems that may indicate z= tag misconfiguration. These can break authentication or trigger spam filters. You can fix them at source instead of after sending.

Why this stops sending failures before they happen

Canonicalization mismatches—where the same email is interpreted differently due to whitespace, casing, or z= tag usage—break SPF and DKIM alignment, often silently. A 2023 analysis by Return Path found that 32% of authentication failures stemmed from header misalignment, not just missing records. MailTester surfaces these issues during verification, not after delivery. It’s not just about catch-all detection; it’s about ensuring your sending infrastructure stays aligned under real-world parsing rules.

Use the bulk list verification feature to scan entire lists. Check inbox placement with real inbox placement tests for final validation. You don’t need guesswork—MailTester’s reports show exactly where your list fails and why. This level of insight is a core part of maintaining sender reputation and consistent inbox placement.

Why relying only on email addresses being valid isn't enough for inbox placement

Just because an email address is syntactically correct and delivers a bounce doesn’t mean it will land in the inbox. Major providers like Gmail and Yahoo evaluate authentication alignment and header processing—especially DKIM’s z= tag and header canonicalization. A mismatch here, even with a valid address, can trigger rejection. It’s not just about delivery; it’s about technical correctness.

Authentication alignment can fail even with a valid address

Imagine sending to an address that passes basic syntax checks but whose domain has a broken DKIM alignment. The email might not bounce, but it will be flagged or filtered as suspicious. That’s because modern inbox providers use DMARC policies to verify that both SPF and DKIM align with the sender’s domain. If DKIM’s signed headers don’t match the headers processed by the receiving server, alignment fails—even if the address itself is valid.

One common issue is a z= tag mismatch. The z= tag in a DKIM signature specifies which headers were included in the signature. If the receiving server canonicalizes headers differently than the sender did, or if the z= tag references headers that were dropped or altered in transit, the signature fails verification. This usually results in a hard bounce or inbox placement issues, even if the email structure is otherwise correct.

Headers and canonicalization matter more than you think

Many senders assume that if the To: and From: fields are formatted properly, the rest of the mail is safe. But header canonicalization—the way email servers normalize whitespace, line breaks, and field order—can differ between systems. A signature created with standard line breaks might fail if the receiving server expects folded lines. These subtle differences aren’t caught by simple syntax checks.

According to the IETF’s RFC 6376 (which defines DKIM), alignment failure due to header processing is a common cause of delivery issues. Even small discrepancies in how headers are processed can disrupt authentication, and most email validation tools don’t test for this. That’s why using an email authentication tool to detect z= tag mismatches and header canonicalization issues is essential for maintaining sender reputation.

MailTester’s inbox placement tests and bulk verification processes include checks for these technical alignment defects. It doesn’t just confirm that an address exists—it verifies whether the domain’s DKIM setup is properly aligned and whether header processing is consistent. If you’re sending to a large list, this is the difference between being delivered and being silently quarantined.

For more insight, you can test individual addresses with our email checker or verify entire lists with bulk verification, both of which surface technical authentication flaws that simple validity checks miss.

Fixing z= tag and header issues proactively prevents long-term deliverability problems

Canonicalization mismatches in email authentication can silently degrade sender reputation over time. By addressing z= tag inconsistencies early, you prevent cumulative damage that’s hard to reverse after multiple bounces or blocks.

Deliverability isn’t just about sending—it’s about consistency. A single misconfigured header can trigger sudden drops in inbox placement, even for domains with a strong history. Catching these issues before a campaign goes live avoids the cost and complexity of post-send cleanup.

MailTester offers granular insight into authentication behavior, including z= tag validation and header canonicalization, which many tools overlook. This visibility lets you act before failures happen, not after.

Sources

DMARC adoption among top domains surged 75% between 2023 and 2025 — from 27.2% to 47.7% — in the wake of Google and Yahoo's bulk-sender authentication requirements. — EasyDMARC 2025 DMARC Adoption Report (2025)
Since May 5, 2025, Microsoft Outlook requires SPF, DKIM, and DMARC from domains sending 5,000+ emails per day, rejecting non-compliant mail outright at the SMTP level with error 550 5.7.515. — Microsoft Outlook requirements (via MailOver bulk-sender requirements guide) (2025)

Keep reading

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

What is a z= tag in a DKIM signature?

The z= tag in a DKIM signature indicates the canonicalization method used for headers during signing. Values like 'header=relaxed' or 'header=strict' must match the receiver’s processing method.

Why does header canonicalization matter for email delivery?

If the way headers are processed during delivery doesn’t match the canonicalization method used during signing, the DKIM check fails, potentially resulting in spam filtering or rejection.

Can I fix z= tag mismatches without changing my email provider?

Yes—by adjusting your DKIM signing configuration to match the receiver’s expected canonicalization. MailTester helps identify the mismatch so you can fix it.

How does MailTester detect z= tag and header mismatch?

It analyzes DKIM signatures and header processing during simulation, comparing z= tag values against the canonicalization applied during receipt testing.

Do all email providers check canonicalization in DKIM signatures?

Yes—major providers like Gmail, Yahoo, and Outlook enforce strict DKIM alignment. Mismatches are logged and impact deliverability.

Can a valid email address still be blocked due to a z= tag mismatch?

Yes—validity checks don't cover authentication alignment. A valid address with a technical DKIM mismatch may still be blocked or marked as spam.

How accurate is MailTester at detecting authentication issues?

MailTester achieves 98.9% accuracy in verifying email addresses and detecting technical issues, including DKIM and header alignment anomalies.

Is there a free way to test for z= tag mismatches?

Yes—MailTester offers 100 free verifications to start. Use it to test individual addresses or small batches to check DKIM and canonicalization behavior.

How do I know if my email provider applies relaxed or strict header canonicalization?

Check your provider’s documentation on DKIM signing. If unsure, test with MailTester’s inbox-placement test to see how headers are processed.

What happens if a z= tag mismatch isn’t fixed?

Repeated mismatches degrade sender reputation, increase spam score, and reduce inbox placement. It can lead to domain-level filtering over time.