diff --git a/dkimHeader.go b/dkimHeader.go
index 11563a8..986ce51 100644
--- a/dkimHeader.go
+++ b/dkimHeader.go
@@ -322,6 +322,11 @@ func parseDkHeader(header string) (dkh *dkimHeader, err error) {
 	fs := strings.Split(val, ";")
 	for _, f := range fs {
 		flagData := strings.SplitN(f, "=", 2)
+		// https://github.com/toorop/go-dkim/issues/2
+		// if flag is not in the form key=value (eg doesn't have "=")
+		if len(flagData) != 2 {
+			return nil, ErrDkimHeaderBadFormat
+		}
 		flag := strings.ToLower(strings.TrimSpace(flagData[0]))
 		data := strings.TrimSpace(flagData[1])
 		switch flag {
diff --git a/errors.go b/errors.go
index 06f587e..80a99da 100644
--- a/errors.go
+++ b/errors.go
@@ -5,7 +5,7 @@ import (
 )
 
 var (
-	// ErrConfigPrivateKeyRequired when there not private key in config
+	// ErrSignPrivateKeyRequired when there not private key in config
 	ErrSignPrivateKeyRequired = errors.New("PrivateKey is required")
 
 	// ErrSignDomainRequired when there is no domain defined in config
@@ -14,34 +14,37 @@ var (
 	// ErrSignSelectorRequired when there is no Selcteir defined in config
 	ErrSignSelectorRequired = errors.New("Selector is required")
 
-	// If Headers is specified it should at least contain 'from'
+	// ErrSignHeaderShouldContainsFrom If Headers is specified it should at least contain 'from'
 	ErrSignHeaderShouldContainsFrom = errors.New("header must contains 'from' field")
 
-	// If bad Canonicalization parameter
+	// ErrSignBadCanonicalization If bad Canonicalization parameter
 	ErrSignBadCanonicalization = errors.New("bad Canonicalization parameter")
 
-	// when unable to parse private key
+	// ErrCandNotParsePrivateKey when unable to parse private key
 	ErrCandNotParsePrivateKey = errors.New("can not parse private key, check format (pem) and validity")
 
-	// Bad algorithm
+	// ErrSignBadAlgo Bad algorithm
 	ErrSignBadAlgo = errors.New("bad algorithm. Only rsa-sha1 or rsa-sha256 are permitted")
 
-	// ErrBadMailFormat
+	// ErrBadMailFormat unable to parse mail
 	ErrBadMailFormat = errors.New("bad mail format")
 
-	// ErrBadMailFormatHeaders
+	// ErrBadMailFormatHeaders bad headers format (not DKIM Header)
 	ErrBadMailFormatHeaders = errors.New("bad mail format found in headers")
 
-	// ErrBadDKimTagLBodyTooShort
+	// ErrBadDKimTagLBodyTooShort bad l tag
 	ErrBadDKimTagLBodyTooShort = errors.New("bad tag l or bodyLength option. Body length < l value")
 
+	// ErrDkimHeaderBadFormat when errors found in DKIM header
+	ErrDkimHeaderBadFormat = errors.New("bad DKIM header format")
+
 	// ErrDkimHeaderNotFound when there's no DKIM-Signature header in an email we have to verify
 	ErrDkimHeaderNotFound = errors.New("no DKIM-Signature header field found ")
 
 	// ErrDkimHeaderBTagNotFound when there's no b tag
 	ErrDkimHeaderBTagNotFound = errors.New("no tag 'b' found in dkim header")
 
-	// ErrDkimHeaderNoFromInHTag
+	// ErrDkimHeaderNoFromInHTag when from is missing in h tag
 	ErrDkimHeaderNoFromInHTag = errors.New("'from' header is missing in h tag")
 
 	// ErrDkimHeaderMissingRequiredTag when a required tag is missing
@@ -50,7 +53,7 @@ var (
 	// ErrDkimHeaderDomainMismatch if i tag is not a sub domain of d tag
 	ErrDkimHeaderDomainMismatch = errors.New("domain mismatch")
 
-	// Version not supported
+	// ErrDkimVersionNotsupported version not supported
 	ErrDkimVersionNotsupported = errors.New("incompatible version")
 
 	// Query method unsupported
@@ -59,7 +62,7 @@ var (
 	// ErrVerifyBodyHash when body hash doesn't verify
 	ErrVerifyBodyHash = errors.New("body hash did not verify")
 
-	// ErrVerifyNoKeyForSignature
+	// ErrVerifyNoKeyForSignature no key
 	ErrVerifyNoKeyForSignature = errors.New("no key for verify")
 
 	// ErrVerifyKeyUnavailable when service (dns) is anavailable