dkim=fail (body hash did not verify) is not a generic instruction to replace a DNS record. It means the receiver canonicalized the delivered message body, calculated its hash, and did not get the value stored in the signature's bh= tag. A footer, link wrapper, MIME conversion, security ...