André Peters:
I run a smtpd_milter to sign mail via OpenDKIM. This happens before-queue, right?
in your setup, right.
Next this signed mail goes through a Spamassassin content-filter, which adds some X-Headers after-queue.
OpenDKIM don't sign X- headers by default and your spamassassin don't alter the messages.How can this mail still have a valid DKIM signature?
So the signatures keep valid. Andreas