Fix DMARC Failure from DKIM c=simple

Why does DKIM c=simple break DMARC alignment in 2026?

You send a transactional email, it passes SPF, and DKIM signs it with c=simple. The recipient’s server checks DMARC, and suddenly it fails—despite everything looking correct. Why?

Because c=simple in DKIM allows arbitrary header reformatting. A single line break, extra space, or reordered header can invalidate the signature. If that signature doesn’t match the domain in the From header, DMARC alignment fails—no matter how clean the rest of your setup is.

DKIM’s c=simple canonicalization was designed for flexibility, not integrity. In 2026, as DMARC enforcement tightens across major inboxes, that flexibility becomes a liability. The domain in the From header must align with the DKIM-signed domain—and c=simple breaks that alignment under real-world header manipulation.

Key takeaways

DKIM c=simple canonicalization allows header changes that invalidate signatures, breaking DMARC alignment.
Most reputable email receivers require strict header alignment between the From header and DKIM-signed domain.
Using c=relaxed instead of c=simple in DKIM preserves signature validity across common header modifications.

What is c=simple in DKIM, and why does it matter?

DKIM’s c=simple setting means minimal header and body normalization—only trailing whitespace is trimmed, no header reordering or body restructuring occurs. This speeds up signing but raises the risk of signature failure if any intermediate mail server alters the message, even slightly. If your emails fail DMARC due to DKIM mismatches, c=simple is likely the culprit.

How DKIM canonicalization affects message integrity

When a message is signed with DKIM, it must be standardized before hashing—this is canonicalization. c=simple applies just one rule: trim whitespace at the end of lines. It doesn’t reorder headers or collapse whitespace in the body. While this makes signing faster, it offers little protection against small, common changes made by mail servers during transit.

For example, if a gateway adds a tracking header or reformats line breaks in the body, a c=simple signature becomes invalid, even if the message content is otherwise unchanged. That failure breaks DMARC alignment, leading to rejection or marking as spam.

Why `c=relaxed` is the safer default

Using c=relaxed instead of c=simple applies more rigorous normalization—headers are ordered alphabetically, and body whitespace is collapsed. This reduces the odds of signature mismatches when your email passes through multiple relays.

While c=relaxed slightly increases signing time, it's a reliable defense against DMARC failures. Most major platforms (Google, Microsoft) expect c=relaxed in production environments. The RFC 6376 specification explicitly recommends relaxed canonicalization for production mail, citing its effectiveness in real-world delivery.

Let’s be clear: c=simple isn’t wrong per se—it’s just unsafe for reliable delivery. For most senders, switching to c=relaxed eliminates a common cause of DMARC failure.

To test your DKIM configuration and catch issues like this before they hit your deliverability: run an inbox placement test with MailTester. It checks alignment, signature validity, and DMARC status across real inboxes, giving you a real-world look at your email’s integrity.

How c=simple breaks DMARC alignment in practice

You can’t rely on c=simple for DKIM signing if your message might be relayed, reformatted, or modified in transit — even a single added newline in a header field can break the signature. Since c=simple doesn't allow any header changes, any alteration during delivery invalidates the signature, causing DMARC to fail because the DKIM-signed domain no longer aligns with the From domain after reconstruction.

Why c=simple is fragile in real-world email flows

Let’s say you send with c=simple. Your message goes through an outbound MTA, a corporate relay, or an ESP that adds a tracking header. Even if that header is added just after the original body, a single newline or whitespace change in the header field can invalidate the DKIM signature.

This happens because c=simple enforces strict, exact matching of header content — no variations allowed. If the MTA reorders a header, inserts a single space, or adds a trailing newline, the signed content no longer matches the actual message. The DKIM verification fails, and DMARC, which relies on alignment between the From domain and the DKIM-signed domain, rejects the email.

How relaxed alignment protects against this fragility

c=relaxed, by contrast, allows minor header modifications during transit — such as whitespace normalization or line breaks — and still validates the signature. This is why c=relaxed is the default and recommended choice in practice.

As noted in RFC 6376, DMARC enforcement depends on the integrity of both DKIM and SPF mechanisms. If your DKIM signature uses c=simple, you're not just risking a failed signature; you're inviting failure at the DMARC level, especially when messages travel through multiple intermediaries. You're essentially hardcoding a fragile expectation that no one will touch your message — which almost never happens in real email delivery.

For organizations sending across multiple MTAs or using cloud-based email platforms, c=simple isn’t just risky — it’s a misconfiguration. The best practice is to always use c=relaxed unless you have a very specific, controlled environment where message content never changes after signing.

To audit your email setup and check whether your DKIM alignment is compromised by signature settings, test real delivery paths using inbox placement tools. Our inbox tester helps you verify how your messages survive transit and DMARC checks: see how your emails land across inboxes and whether alignment is preserved.

How to verify if your messages are failing due to c=simple

You can confirm if your messages are failing due to c=simple by checking the DKIM-Signature header in delivered emails. If the c= tag shows simple, it may cause alignment failures with strict DMARC policies, especially when headers are modified by forwarders or mailing lists. Use a tool that mimics real delivery paths—including MTA changes—to spot inconsistencies early. You'll know it's a problem when DKIM passes but DMARC fails across multiple providers.

Step-by-step diagnostic checklist

Send a test message through your production setup to a real recipient address (not a tester inbox).
Retrieve the full message headers from the recipient’s inbox—ideally one that shows the original DKIM-Signature line.
Locate the DKIM-Signature header and check the value of the c= tag. If it's c=simple, it’s vulnerable to breaking under DMARC with reject policies.
Compare the DKIM signature’s c= value to the alignment outcome across different email providers (e.g., Gmail, Outlook, Yahoo). Consistent failures on one but not others suggest MTA modifications affecting the signature.
Use an inbox placement testing tool that simulates real delivery paths and includes MTA filtering behavior. Tools like MailTester’s inbox placement checker reveal how your messages fare after being processed by gateways, forwarders, and link sanitizing services.
Validate against RFC 6376, which defines how c=simple and c=relaxed affect signature alignment under DMARC. A c=simple signature only aligns if the entire header set is preserved.

Why consistency matters across providers

Even if your message passes DKIM locally, the header changes introduced by mailing lists, forwarders, or corporate filters may invalidate the c=simple signature. This means DMARC fails—not because your domain is compromised, but because the signature alignment is broken at delivery. Use a tool that checks results across multiple domains (e.g., Gmail, ProtonMail, Outlook) to confirm whether alignment fails consistently or only in specific environments.

Real-world delivery is not static. The best way to catch this is to test with real email traffic in real inboxes—not static headers or synthetic validation. Tools that replay full delivery logic, including header modifications by MTAs, are the only way to detect subtle signature misalignments.

How to test and validate DMARC alignment with real messages

Send real messages through your email providers and inspect the DKIM-Signature header for c=simple or c=relaxed. Verify the signature matches the actual message content and headers using a DKIM validator. Then, run inbox placement tests across multiple providers to confirm your DMARC alignment holds in practice.

Step-by-step: Verify DKIM c= alignment with real messages

Send a test message from your domain via Mailgun, SendGrid, or Amazon SES—each uses different DKIM signing behavior. This reveals how your provider handles header and body canonicalization.
Check the delivered DKIM-Signature header for c=simple or c=relaxed. If you see c=simple, the signature only validates the exact header order and body format sent—failures are more likely if email clients or filters modify whitespace or line breaks.
Use a trusted DKIM verifier like RFC 6376 or a tool such as DKIM Validator to test the signature against the actual message headers and body. Any mismatch confirms the alignment failure.
Inspect the message as received by recipient providers. A c=simple signature may break during transit due to email client reformatting, while c=relaxed handles such changes more gracefully.
Run an inbox placement test with MailTester’s inbox placement tester. It sends a real message through multiple providers and reports how it lands—inbox, spam, or blocked—and whether DKIM alignment passes.

Why alignment matters for DMARC

DMARC requires DKIM and SPF alignment with your domain. If DKIM uses c=simple but your provider or intermediary modifies whitespace or line breaks in transit, the signature fails. Even if DMARC policy is set to none, misaligned signatures count as failures and harm sender reputation over time.

Use MailTester's bulk verification to pre-screen your email list and catch malformed or suspicious addresses before they impact deliverability—even if your DKIM is set to c=relaxed, a dirty list can still trigger filtering.

Aligning your signing method with how email flows through the internet reduces false negatives and keeps your reputation intact. The goal is consistency: a signature that passes validation in the real world, not just on paper.

What to do when c=simple causes DMARC to fail

If your DMARC policy is failing due to a DKIM signature with c=simple, switch your DKIM signing configuration to use c=relaxed. This mode normalizes whitespace and ignores header order, preventing signature mismatches caused by minor email modifications during transit. Most major email providers, including Microsoft and Google, expect relaxed canonicalization for reliable DMARC alignment.

Why c=simple breaks DKIM alignment

With c=simple, the DKIM signature is tied to the exact byte sequence of headers, including spacing and order. Even small changes—like a line break added by a forwarder or an outbound gateway—can invalidate the signature, causing DMARC to fail. This is especially common in routed or forwarded emails where message rewriting is standard.

Relaxed mode addresses this by normalizing the header field values and ignoring line wrapping and field order. For example, two header lines with the same content but different whitespace or order will still pass validation. This makes DKIM signatures significantly more resilient across email gateways, filters, and forwarders.

How to enable relaxed canonicalization

Check your email service, ESP, or mail server’s DKIM signing configuration. Look for a setting labeled canonicalization, c=, or mode. Change it from simple to relaxed. If you're using a custom signing system or a mail server like Postfix or Exim, consult the documentation for your specific signing implementation—most modern systems support relaxed mode.

You can verify if your DKIM signature is using relaxed mode by checking the h= field in the DKIM-Signature header. If it includes fields like from:to:subject without strict ordering, and the c=relaxed attribute is present, your setup is correctly configured. You can examine a real DKIM header using tools like MxToolbox’s DKIM Analyzer or RFC 6376, Section 3.3, which defines canonicalization modes.

Once relaxed mode is active and properly applied, your DKIM alignment with DMARC will improve dramatically, reducing the risk of deliverability issues. Test with a few real messages using inbox placement tools to confirm your sender reputation remains intact. For a real-world verification of your sending setup before deployment, run a test through our inbox placement tester, which checks DMARC, DKIM, SPF, and routing behavior across multiple inboxes.

How MailTester helps prevent DKIM/DMARC alignment failures

You can prevent DKIM/DMARC alignment failures from c=simple signatures by testing messages in real delivery paths. MailTester’s inbox-placement tests send your email through actual provider networks and check DKIM and DMARC alignment under live relay conditions. This reveals whether a c=simple signature breaks alignment when messages are forwarded, rewrapped, or processed by third-party services — a common failure mode missed by static validators.

Real delivery paths expose hidden alignment issues

Many tools verify email addresses based on syntax or basic DNS checks, but they don’t simulate how your message behaves when it travels through Gmail, Outlook, or Yahoo. With MailTester’s inbox-placement tests, your message is sent via real SMTP relays and analyzed in the actual delivery path. This includes how DKIM signatures hold up when headers are altered during forwarding, or when mail is processed through services like Amazon SES or SendGrid.

When a DKIM signature uses c=simple and your message gets rewrapped, the signature may fail alignment at DMARC evaluation. This happens because c=simple requires exact header matching — a strict requirement that fails under real-world conditions. MailTester detects these failures before you send, showing you exactly where and why alignment breaks.

Fix issues before they hurt your sender reputation

Use MailTester’s real-time API or bulk verification to catch alignment-breaking signatures early. Run your outgoing messages through the inbox placement tests before sending to your list. This tells you if a c=simple signature will fail under live delivery, so you can switch to c=relaxed in your DKIM signing process.

Alignment failures can lead to DMARC rejections, even with valid DKIM signatures. According to the DMARC specification (RFC 7672), relaxed alignment is recommended for most email, especially when messages pass through intermediaries. By testing under real-world conditions, you ensure that your DKIM and DMARC alignment holds up — not just on paper, but in practice.

Integrate MailTester with tools like Mailchimp, HubSpot, or Klaviyo via the integration suite to validate email lists and messages automatically. With 98.9% accuracy, MailTester helps you avoid bounces, sender reputation damage, and low inbox placement — all from failures that should have been caught before sending.

Best practices for DKIM and DMARC alignment in 2026

Always use c=relaxed for DKIM canonicalization instead of c=simple. This ensures alignment with DMARC policies across forwarding and email clients, reducing failure rates. Proper alignment across SPF, DKIM, and DMARC across all sending sources—both direct and third-party—is essential. Monitor DMARC reports to catch alignment issues early, and verify your lists regularly using tools like MailTester to filter out invalid, catch-all, or role-based addresses that harm sender reputation.

How to prevent DMARC failure with DKIM canonicalization

Set c=relaxed in your DKIM signature—never use c=simple. Simple canonicalization breaks alignment when messages are forwarded or modified, leading to DMARC failures.
Test your DKIM configuration with tools that validate both the signature and canonicalization mode. RFC 6376 defines the expected behavior, and relaxed mode is the standard across major mailbox providers.
Ensure all sending sources—your own systems, ESPs, and partners—use consistent alignment. A single misaligned email can cause a DMARC reject, especially if your policy is set to reject.

Monitoring and list hygiene to protect deliverability

Regularly analyze DMARC aggregate reports to detect alignment failures and unknown senders. Tools like MailTester’s integrations with platforms like SendGrid and Klaviyo help automate this step.
Use real-time verification to scrub lists of catch-all or role accounts (like admin@, postmaster@, sales@). These accounts are often not monitored and increase bounce rates, harming sender reputation.
Verify every address before sending using MailTester’s email checker—it checks validity, deliverability, and role account status in under a second.
Run inbox placement tests across major providers using MailTester’s inbox tester to confirm your messages land in inboxes, not spam folders.

Alignment isn’t optional—it’s the foundation of DMARC enforcement. A single misaligned signature can block your entire domain’s email delivery.

Common misconceptions about DKIM canonicalization

DKIM’s c=simple is not broken—it’s just fragile when email headers or body content change during transit. Many systems expect c=relaxed for reliability, especially when MTAs or ESPs reorder headers or normalize whitespace. Even small transit changes can break a c=simple signature, leading to DMARC failures, regardless of your key setup.

Why `c=simple` fails in real-world delivery

You might assume c=simple works if your headers look consistent in a test. But in practice, email journeys involve multiple hops—MTAs, filtering services, ESPs—all of which may rearrange or normalize whitespace in headers. A signature made with c=simple breaks immediately if the order or spacing differs from the original.

For example, a header like From: [email protected] might become From: [email protected] on the next hop, even if the content is identical. With c=simple, that change invalidates the signature. With c=relaxed, such minor changes are normalized, preserving validity.

Expectations vs. reality in modern email delivery

Some ESPs and security gateways enforce c=relaxed as a requirement. Even if your domain uses c=simple, a receiving system may still reject or flag messages if it sees deviation. This mismatch leads to unexpected DMARC failures, especially when sending through platforms like SendGrid or Amazon SES that may apply their own header normalization.

It’s not that c=simple is obsolete—it’s a valid choice for systems with strict, predictable delivery paths. But in most real-world setups, that predictability doesn’t hold. The assumption that “as long as the headers look the same, the signature will work” is flawed. The email path is never static.

Check your DMARC reports regularly. If you see dkim=fail from DMARC, look for c=simple in the signature. Tools such as MailTester’s email checker can verify if a domain’s DKIM setup is vulnerable to transit changes, even before sending.

Always test DKIM in real delivery conditions. Don’t rely on static headers in a debug tool. The inbox placement tool simulates delivery through real providers to check if your signature holds up under actual transit. It’s the only way to confirm that DKIM remains valid after all the real-world modifications emails face.

How to audit your email infrastructure for alignment issues

You can prevent DMARC failures caused by DKIM c=simple by auditing all outbound email paths — marketing, transactional, support — to ensure consistent DKIM signing with c=relaxed and proper DKIM/SPF alignment. This reduces the risk of rejection due to mismatched identities, especially when third-party services are involved. Use real verification tools to test before sending.

Step 1: Validate DKIM configuration across all sending sources

DKIM c=simple checks the full header and body, which can fail when email clients or forwarders alter content. Use MailTester's real-time verification API to test the DKIM signature of each outbound email path — including platforms like Mailchimp, SendGrid, or in-house transactional systems. You’ll catch misconfigured or relaxed signatures before campaigns go live.

Step 2: Run inbox placement tests across major providers

Even with correct DKIM/SPF alignment, DMARC can fail if receiving inboxes don’t see a consistent alignment. Use MailTester's inbox-placement tests to simulate how your message lands in Gmail, Outlook, Apple Mail, and others. These tests reveal whether your domain’s DMARC policy is being enforced due to relaxed or strict alignment issues. The results mirror real-world behavior, not just technical compliance.

Check every outbound email path — transactional, marketing, support — for consistent DKIM signing. Third-party tools often default to c=simple, which breaks when headers are modified.
Verify DKIM’s canonicalization — ensure c=relaxed is set in all systems. This allows minor formatting changes without invalidating the signature.
Use MailTester’s bulk verification tool to audit large address lists before sending. It detects invalid, catch-all, or risky addresses that may trigger DMARC anomalies if sent from inconsistent sources.
Run checks quarterly or after infrastructure changes — new senders, migration tools, or email routing updates can reintroduce alignment issues.
Monitor DMARC reports — parse your DMARC aggregate reports to spot failed alignments. Correlate them with the signing source to identify misconfigured systems.

The 5 steps described in “Step 2: Run inbox placement tests across major providers”, in order.

Certain configurations, like using c=simple with a third-party ESP, are common causes of DMARC failures. As RFC 6376 notes, relaxed canonicalization is the standard for reliable email authentication. When in doubt, assume c=relaxed is safer than c=simple — especially across diverse delivery paths.

Final takeaway: keep your DKIM aligned to avoid DMARC failure

Using c=simple in DKIM signatures is a common reason for DMARC failure, especially in modern email workflows where content modifications happen during transit. This canonicalization method requires exact byte-level matching, which breaks when headers or body content are altered.

The fix is straightforward

Switching DKIM canonicalization to c=relaxed allows for minor changes during routing without invalidating the signature. This alignment ensures DMARC passes consistently across all major inboxes. It’s a low-risk, high-impact configuration change.

Test in real conditions

Don’t assume alignment works just because your DNS records are correct. Use real-world testing with tools that simulate actual message delivery. Validate alignment before scaling sends or relying on reputation.

Sources

Since May 5, 2025, Microsoft Outlook requires SPF, DKIM, and DMARC from domains sending 5,000+ emails per day, rejecting non-compliant mail outright at the SMTP level with error 550 5.7.515. — Microsoft Outlook requirements (via MailOver bulk-sender requirements guide) (2025)
Roughly one in six legitimate commercial emails (16.5%) never reaches the inbox globally — 6.7% is filtered to spam and 9.8% disappears without a bounce. — Validity 2025 Email Deliverability Benchmark Report (2025)

Keep reading

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

What does DKIM c=simple mean in a header?

c=simple means the DKIM signature uses minimal canonicalization—only whitespace trimming, no header reordering or body normalization.

Why does c=simple cause DMARC to fail?

Because small changes in the header or body during transit can invalidate the signature if c=simple was used, breaking alignment.

Is c=relaxed better than c=simple for delivery?

Yes—relaxed mode normalizes whitespace and allows header reordering, making signatures more resilient to transit changes.

Can I fix DMARC alignment without changing DKIM?

No—alignment issues come from signing configuration, usually requiring a change to canonicalization mode or domain alignment.

How can I test if my DKIM is aligned with DMARC?

Send test messages through real delivery paths and verify the DKIM signature and From domain alignment using tools like MailTester.

Does MailTester detect c=simple issues?

Yes—MailTester’s inbox-placement tests evaluate DKIM signature validity and alignment under real routing conditions.

Why does my DMARC report show failing alignments?

Failing alignments are often due to misconfigured DKIM, especially using c=simple when relaxed is required.

Should I avoid c=simple entirely?

Yes—c=simple is not resilient to real-world message transit and should be avoided unless strict control over content is guaranteed.

How common is c=simple causing DMARC failure?

It's surprisingly common—many misconfigured systems use it by default, leading to alignment breaks in transit.

Do all ESPs support relaxed DKIM?

Yes—major platforms like SendGrid, Mailchimp, and Amazon SES expect or require relaxed mode for reliable delivery.

Does DKIM c=relaxed affect performance?

Minimal—relaxed mode adds little overhead, and the improved deliverability far outweighs any minor delay.

Can I use both c=simple and c=relaxed?

Yes, but only if you control the entire delivery path. Mixing can cause delivery inconsistencies.