Hi Rupert,
I know this is an old post, but I didn't see any replies, here, so I'm guessing you haven't solved it.
I assume you acting as the mail client, or the mail server? If you are acting as the mail client, then the mail server is charged with signing the message on the way out. If you're using GSuite, or Office365, for instance, there are plenty of resources for configuring DKIM. If you're acting as the mail server, then I'm afraid I don't have any guidance for you, but there must be RFCs on the subject you could lean on.