[Mailman-Users] DKIM best practise

[Yasir Assam]

I have a list which all subscribers can post to.

I'm using mailman 2.1.18 on Debian Jessie with exim4. I have full
personlisation and verp turned on.

What should I do about DKIM?

At the moment I preserve the original poster's DKIM header and my list's
MTA also adds DKIM to all outgoing mail.

If I set from_is_list to Munge, hotmail users can't reply to the list,
even when they hit Reply All (if I try doing Reply All from a hotmail
account, I only see the sender's address, not the list address). If it
wasn't for this hotmail problem, I'd probably prefer to have a munged
from header.

If I set from_is_list to No, the hotmail Reply All problem goes away,
but now Yahoo-sent email ends up in Yahoo's spam (i.e. if
bob at yahoo.com.au sends to list at example.com, bob receives the email he
just posted in his spam folder, not in his inbox). I'm specifically
talking about a yahoo.com.au address (I haven't tried yahoo.com yet).

Just to be clear, when from_is_list is No, the DKIM header I'm adding is
for the list domain, e.g. if the list is list at example.com then
d=example.com in my added DKIM header.

Here's an example Authentication-Results added by a gmail subscriber
receiving a post from a yahoo.com.au subscriber (names changed):

Authentication-Results: mx.google.com;
       spf=pass (google.com: domain of
list-bounces+bob=gmail.com at example.com designates x.x.x.x as permitted
sender) smtp.mail=list-bounces+bob=gmail.com at example.com;
       dkim=pass header.i=@example.com;
       dmarc=fail (p=NONE dis=NONE) header.from=yahoo.com.au

So what is the recommended way of doing this? Should I not bother adding
a DKIM header to mailman-sent emails? Should I strip the original DKIM
header (REMOVE_DKIM_HEADERS) ?

Is there any way I can get hotmail to reply to the list when the From:
header is munged? Is munging considered bad form (when not mitigating
DMARC reject policies)?

Thanks,
Yasir