What unusual DKIM canonicalization types reveal about a mail system

DKIM is one of those email authentication protocols that sits quietly in the background, signing messages so receiving servers can verify they have not been tampered with. Most mail administrators rarely look past the d= and s= tags. Yet the c= tag, which controls canonicalization, can quietly reveal a great deal about how a mail system has been built, configured, or even compromised. Learn more about How To Identify A Domain That Has Been Hijacked For Spam Campaigns Tips.

For teams across Australia running their own mail infrastructure, whether they operate an e-commerce shop in Brisbane or a research office in Perth, these subtle signature oddities often surface during routine deliverability investigations. A shift in canonicalization can point to a new MTA, a misconfigured signing server, or something more concerning that deserves a closer look. Learn more about What A High Volume Of Dmarc Failures From A Single Ip Address Means Overview.

An unusual c= value, such as relaxed/relaxed being flipped to simple/simple, or a non-standard variant creeping into inbound mail, rarely happens by accident. It is worth understanding what these signatures are quietly telling you about the sending environment before deciding on a response.

What DKIM canonicalization actually controls

The c= tag in a DKIM-Signature header defines how the message body and headers are processed before the hash is generated. There are two main methods, simple and relaxed. Simple canonicalization is strict and almost punishingly so, requiring near-identical whitespace between the signed and received versions. Relaxed canonicalization normalises whitespace, ignores case differences in headers, and tolerates minor formatting changes introduced by intermediate servers.

Most legitimate senders, especially bulk senders and ESPs, default to relaxed/relaxed because it is forgiving. A simple/simple signature, by contrast, often suggests either an older legacy system or a custom-built tool that was never updated when best practices evolved. It can also point to a system set up by a developer who did not fully understand the downstream implications.

For Australian organisations still using older on-premise Exchange servers or custom .gov.au correspondence systems, this kind of legacy configuration is not unusual. Many of these setups predate modern DKIM guidance issued by the ACSC.

When simple/simple shows up unexpectedly

If your domain has been signing with relaxed/relaxed for years and suddenly a simple/simple signature arrives in your inbox claiming to be from your domain, that is a red flag worth investigating. It could mean a forwarder, an intermediate relay, or an attacker has inserted themselves into the path between your outbound mail and the recipient.

In practice, simple/simple often appears when messages pass through legacy gateways or older appliances that do not tolerate relaxed body normalisation. Australian telcos such as Telstra and Optus have historically operated older mail relay equipment on their business SMTP paths, which can re-sign or strip DKIM signatures, sometimes producing unusual variants that do not match your published policy.

This is also where tools that analyse DKIM signatures in bulk become valuable. If you are seeing these anomalies on incoming mail, you may want to confirm whether your own domain has been used in spoofing campaigns, which is covered in a practical guide on identifying hijacked domains at Trusted Sender Score.

Why attackers sometimes force specific canonicalization

A clever attacker controlling part of the message path can attempt to manipulate signed content to produce a valid signature under a chosen canonicalization method. While rare, this has been documented in advanced phishing kits that target financial services, including several Australian banks that have published customer advisories over the past two years.

The goal is usually to bypass downstream filters that trust any message carrying a valid DKIM pass. If the attacker knows your domain uses a specific signature scheme, they can craft a spoofed message to canonicalise identically under that scheme, making the forgery appear legitimate to the receiving MTA.

This is one reason why a high volume of DMARC failures originating from a single IP address should never be ignored. Understanding what those failures mean can help you spot a spoofing infrastructure in operation before it causes reputational damage.

Diagnosing the mail system behind the signature

When you see an unusual canonicalization type, the next step is to identify which server actually produced the signature. DKIM signatures are created by the signing MTA, so any c= value is a fingerprint of that specific component. A change in canonicalization without a corresponding configuration change on your end usually means the signing is happening elsewhere.

Check the signing domain in the d= tag carefully. If it matches your domain but the canonicalization differs from your published record, the signing is not happening on your infrastructure. Australian hosting providers and managed service providers sometimes resell or co-brand email services, and the underlying signing server may produce signatures that do not match expectations.

Look at the timestamp, the message ID, and the receiving chain headers. Together with the c= tag, these create a coherent picture of where the message originated and which hop performed the signing.

Practical steps when you notice the anomaly

First, document the full DKIM-Signature header and the associated Received headers. Do not truncate the body of the signature, since the bh= hash and the canonicalization method are both essential for diagnosis. Save the raw message as an .eml file so it can be analysed offline without further modification.

Run the signature through a verification tool. Trusted Sender Score offers bulk domain checking that can flag unusual signing behaviour across multiple properties, which is useful if you manage a portfolio of Australian .com.au or .org.au domains alongside international assets.

Finally, audit your outbound mail flow. Confirm which MTA is actually performing the signing, ensure the canonicalization matches your policy, and verify that no unauthorised relay is sitting in front of your primary mail server. A consistent signature pattern is one of the quietest signals that your mail system is healthy and untouched.