> Modifying headers -might- mess up DKIM, gpg, etc sigs (depending upon > how they were done). Modifying bodies -will- mess up sigs.
I was not specifically talking about dkim signed mails. It is clear that body rewriting mess up sigs. It is also clear that phishers dont use dkim ! and if they do you have the certainty that the originating domain has nothing to do with what the content claims to be !...unless the phishing comes from the same domain ! (really bizarre) ! :D