If DKIM passes before a gateway and fails after it, the key is probably not your first suspect.
Capture both versions where possible.
Compare:
- Subject changes;
- disclaimer/footer insertion;
- MIME boundary changes;
- content encoding;
- modified signed headers;
- body changes.
Read the signature’s h= list and c= canonicalization setting.
If the gateway must modify outbound mail, consider whether DKIM signing should happen after that modification instead of before it.