Tools · Email security · 22 / 26
A DKIM pass does not cover unsigned headers
A DKIM pass means the headers named in h= and the body hash verified. A header that is not in that list is outside the pass. Write the list, and do not treat the pass as a seal on every line.
h= is the list that was signed
The h= tag on DKIM-Signature names the headers included in the signature. A pass means those headers, as signed, matched the key for d= and s=. It does not silently add every other header on the message.
From is required to be in the list. Other headers are present only if they appear in h=. Read the tag. Do not assume Subject, Reply-To, or a mailing-list footer header was included.
A header outside the list is unsigned
If Reply-To is not in h=, the pass says nothing about that line. You may still quote Reply-To as a header on the message. You may not say the signature covers it. The same is true for any header missing from the list.
This note does not change a signature and does not describe how to add a header. It only limits what a pass supports.
What to write down
File d=, s=, the h= list, and the pass or fail from your provider’s Authentication-Results. When you cite a header, say whether its name is in h=. If h= was not copied, write “signed header list not in the note.”
Lab: a pass that left Reply-To out
A lab message shows dkim=pass, d=example.org, and h=from:subject:date. Reply-To is billing@other.example. From is billing@example.org. A draft says the pass proves the reply address belongs to example.org.
The note quotes the h= list and says Reply-To is not in it. The pass covers From, Subject, and Date for that signature. It does not cover Reply-To. The reply address stays an unsigned header.
dkim=pass d=example.org h=from:subject:date From: billing@example.org Reply-To: billing@other.example write: pass covers the h= list not: the pass covers Reply-To
Diagram
Signed headers and the rest of the message
The pass follows the h= list.
Covered by a pass. Those header names, as signed
From. Required in the list
Your note. Quote the list you actually copied
Covered by that pass. No
Still on the message. Yes, as an unsigned header
Your note. Do not say the signature seals it
Check yourself
1. h= is from:subject:date and the result is pass. What did the pass cover?
2. Reply-To is absent from h=. What is Reply-To?
3. The note never copied h=. What can you say the pass covered?