I'm trying to weigh up whether DKIM signing should be done by the application sending mail (for instance, the mailing list software you're using) or at the mail transfer agent (sendmail, postfix etc).

Do you know any good arguments either way?

As far as I can see, doing it at the MTA, such as with dkim-milter, is a lot easier to set up.

However, if anyone gets access to the server, even just a normal unprivileged account such as a web hosting client's login, they'd be able to send email using sendmail and get the full blessing of my DKIM signature.

What do you think is the best solution for my situation? I'm using a Debian server with apache, postfix, php&mysql, etc.