Implement DKIM Oversigning

I've noticed in some of my DMARC reports that emails not sent by our server have passed DKIM. Researching this, it appears that legitimate emails are intercepted and then resent using either headers not included in the original email (e.g., CC, BCC, etc.) or including duplicate headers.

To prevent this sort of attack, all headers should be included in the DKIM signature even if they are not used in the email. Additionally, some sites recommend adding duplicate headers (e.g., h=To:To:Subject:Subject:CC:CC etc.) to the DKIM signature to prevent the addition of duplicate headers at a later date.