> It does seem surprising the To: header isn’t one of the headers that is covered by the dkim signature It is, which is why they had to preserve it. The screen

> It does seem surprising the To: header isn’t one of the headers that is covered by the dkim signature It is, which is why they had to preserve it. The screenshot of delivery under the reproduction section shows the original To: address. This isn't the address that it is delivered to; you can deliver an email to any address with any other To: field in it.