Both postfix and dkimproxy do what they say, how you get them to tango is where the fun starts. To my surprise i did not have to do to much to get dkimproxy to sign stuff (one instance instead of many) and when things got reconfigured [my blog] which in testing and with spf the consensus was yes its signed by both of us both in spf and key.
I left postfix and mail systems assuming all was fine and dandy. Then some joker said they did not receive email from us on Yahoo whom dont do spf. I investigate and check things out they go ok but yahoo seem to botch spf records and delete the stuff rather than send a message that say bad. The zoo does not send huge quantities of mail to yahoo types.
I know message signing is good and as yahoo sort of invented version 1 of message signing i was perplexed not that is in use by us. So one day i separate the many instances of postfix and give each one an inbound and outbound dksignng point rather than the one that Yahoo seem to reject.
I run some tests on Yahoo this time and that seems to be preferred. Message signing is cool, as to is spf records but to be as vague as yahoo is something else.
I think i know what i did wrong from a yahoo perspective, spf changed after signing and it cannot tolerate it. Odd but that is the world of plumbing for you. Reconfiguring individual dkim daemons apparently sorted the issue to my knowledge.
Yahoo has shit diagnostics

Funny for the url