Hi David / Jaron
One thought - typically dmarc gets dkim validation from a separate
milter dmarc.
And many folks still run opendkim which is unmaintained.
Versions prior to 2.11.0.Beta2 (which arch kindly offers) are definitely
broken. I don't even trust that one.
Jaron do you run opendkim by chance?
dkimpy-milter seems to work much better than opendkim, though of course
you cannot help what other people's servers run.
I see your dkim is relaxed/relaxed which should help keep your mail
flowing as well.
Just a thought.
gene
