Matt Wilbur EFS via Mailman-users writes:
I'm troubleshooting a similar issue. Can you confirm/share how we set "pure pass-through mode"
Set the body header, the body footer, the subject tag, and the subject serial number to empty or off. Note that "empty" means *empty*, if there are any non-graphic characters (SPC, TAB, etc) that can cause changes to signed portions of the message.
Set body-part filtering, HTML removal, and HTML-to-plain-text translation to off. (These will not be relevant if your test messages are all pure plain text.) Set failed DKIM signature removal to off (IIRC ARC signs these). There shouldn't be any failures in pass-through mode, but let's be sure.
with Mailman3 to ensure it doesn't touch the body or signed header fields?
I think that's enough to guarantee the body and the normally signed header fields are not touched, but of course your MTA might be configured to sign other DKIM header fields (AFAIK that's very unusual though).
Steve