diff --git a/libopendmarc/opendmarc_internal.h b/libopendmarc/opendmarc_internal.h
index 3e8f771..703d552 100644
--- a/libopendmarc/opendmarc_internal.h
+++ b/libopendmarc/opendmarc_internal.h
@@ -209,10 +209,15 @@ typedef struct {
 #define	OPENDMARC_MIN_SHELVES	(1 << OPENDMARC_MIN_SHELVES_LG2)
 
 /*
- * max * sizeof internal_entry must fit into size_t.
- * assumes internal_entry is <= 32 (2^5) bytes.
+ * Largest table size opendmarc_hash_init() will honor. The real
+ * caller (opendmarc_tld.c) only ever asks for 8192; this just keeps a
+ * runaway or hostile tablesize argument from reaching calloc(). Fixed
+ * well below any allocator limit rather than derived from sizeof(size_t),
+ * since the size of OPENDMARC_HASH_SHELF (which includes a pthread_mutex_t)
+ * varies by platform and a sizeof-derived bound can creep past what
+ * calloc() will actually allocate.
  */
-#define	OPENDMARC_MAX_SHELVES_LG2	(sizeof (size_t) * 8 - 1 - 5)
+#define	OPENDMARC_MAX_SHELVES_LG2	24
 #define	OPENDMARC_MAX_SHELVES	((size_t)1 << OPENDMARC_MAX_SHELVES_LG2)
 
 typedef struct {
diff --git a/libopendmarc/tests/Makefile.am b/libopendmarc/tests/Makefile.am
index 59f8a7a..0e900d8 100644
--- a/libopendmarc/tests/Makefile.am
+++ b/libopendmarc/tests/Makefile.am
@@ -1,3 +1,4 @@
+AUTOMAKE_OPTIONS = subdir-objects
 SUBDIRS=testfiles
 LDADD = ../libopendmarc.la $(LIBRESOLV)
 AM_CPPFLAGS = -I.. -I../..
diff --git a/opendmarc/opendmarc.h b/opendmarc/opendmarc.h
index 08ef519..24ccbae 100644
--- a/opendmarc/opendmarc.h
+++ b/opendmarc/opendmarc.h
@@ -37,7 +37,7 @@
 #define	REPORTCMD_EXIT_SUPPRESSED	2	/* ReportCommand sent nothing; all recipients were suppressed by policy (e.g. NoReportsList/StaleMARC), not an error */
 #define	JOBIDUNKNOWN	"(unknown-jobid)"
 #define	MAXARGV		65536
-#define	MAXHEADER	4096
+#define	MAXHEADER	8192
 #define	TEMPFILE	"/var/tmp/dmarcXXXXXX"
 
 #define AUTHRESULTSHDR	"Authentication-Results"