DKIM b= tag
The required tag in a DKIM signature holding the base64 signature value, computed over the signed header fields and the DKIM-Signature header itself.
What it means
b= is the cryptographic signature. To compute it, the signer takes the header fields named in h=, appends the DKIM-Signature header with b= left empty, canonicalizes them and signs the hash with the private key. Because the DKIM-Signature header includes bh=, the body is covered indirectly.
A verifier rebuilds the same input and checks b= with the public key from DNS. If the body hash matches but b= does not verify, a signed header changed in transit, the published key does not match the private key used, or the key record is malformed.
Whitespace inside the b= value is ignored, so signers can fold it across lines.
Related terms
On this site
Sources
What this definition rests on. The wording is ours; the facts are theirs.
All 432 terms in the glossaryThe wiki: blocklists and bounce codes