it never made sense to me why these white-hat hackers don't require payment before disclosing the vulnerability
Later
I wrote this comment before rereading the original post and realizing that they had literally submitted a DKIM report (albeit a rare instance of a meaningful one). Just to be clear: in my original comment, I did not mean to suggest this bug was silly; only that in the world of security bug bounties, DKIM reports are universally viewed as silly.
only thing that matters is the severity and what it allows the attackers to do.