DKIM h= tag
The required tag in a DKIM signature listing, in order, the header fields covered by the signature; the From field must always be on it.
What it means
h= is a colon-separated list such as from:to:subject:date:message-id. Only header fields named there are protected; anything else may be changed or added after signing without breaking the signature. RFC 6376 requires the From field to be signed and lists Reply-To, Subject, Date, To, Cc, References and the List- fields among those worth signing when present.
Names may repeat. Listing a field twice signs two instances, counted from the bottom of the header upward. Listing a field that does not exist signs its absence, so adding it later breaks the signature; that is the idea behind oversigning.
The signature's own DKIM-Signature header is signed automatically and is not listed. In ARC, the ARC-Seal header must not carry an h= tag at all.
Example
h=from:from:to:subject:subject:date:message-id:list-unsubscribeRelated terms
On this site
Sources
What this definition rests on. The wording is ours; the facts are theirs.
All 432 terms in the glossaryThe wiki: blocklists and bounce codes