Slight disagreement " No. AIUI DKIM is supposed to operate mainly between the 1st MTA after the sending MUA and the last MTA before the receiving MUA (though smarter MUAs that sign their own, or verify their own are welcome to try)."
I would suggest that DKIM operates between the signing MTA and the edge boundary MTA of the receiving domain that is the certifier of DKIM signatures which may be a smart MUA but is more likely a filtering MTA at the ISP. Thanks, Bill Oxley Messaging Engineer Cox Communications _______________________________________________ NOTE WELL: This list operates according to http://mipassoc.org/dkim/ietf-list-rules.html
