Jan Eden via Mailman-users writes:
To distribute messages with valid DKIM signatures, I set
remove_dkim_headers: yes
in /etc/mailman3/mailman.cf
That should be "mailman.cfg" for a standard installation, and it may not be in "/etc/mailman3" in a shared hosting situation.
Do you have evidence that removing DKIM headers helps you get mail delivered? (Not adding your own, IMO you should do that regardless of whether you strip existing ones, but removing originals.) The DKIM spec says that you shouldn't, and that consumers should treat invalid signatures no differently from missing signatures. I haven't run into a "public" host that treats an invalid signature as a problem in quite a while.
On the other hand, I know of at least one postmaster who is experimenting with simple "repairs" (namely, stripping list tags and serial numbers from Subject and unwrapping simple MIME structure for Mailman lists at least -- the case where Mailman wraps the original message in multipart/mixed and adds a text/plain part to the message with the footer in it) and checking the original DKIM signature and from alignment on the "repaired" message. I don't know if they're still working on that.
Steve