amavis: don't dkim sign received headers

templates/amavis/65-dkim.j2

-$inet_socket_port = [10024, 10022];
+# {{ ansible_managed }}
+
+# modify listen ports: 10022 for submission, 10024 or the rest
+$inet_socket_port = [10022, 10024];
+
+# definde policy for submission
 $interface_policy{'10022'} = 'SUBMISSION';
 $policy_bank{'SUBMISSION'} = {
     originating => 1,
     smtpd_discard_ehlo_keywords => ['8BITMIME']
 };
+
+# enable signing first, when keys are published
 $enable_dkim_signing = {{ "1" if kolab_amavis_dkim_signing else "0" }};
+
+# don't sign received headers. otherwise wallace will break the signature
+$signed_header_fields{'received'} = 0;