Once you rewrite SMTP headers, you either need to re-DKIM-sign the message or stop checking DKIM
A client found a single recipient domain where every Marketo email went to Spam due to failing DKIM validation. (A bad DKIM signature should really result in the message being →