That’s a very valid point - whitelisting DKIM domains was the quickest option as it is easily parsed and verified. Will certainly look into this.