put all DKIM on the primary hostname since that's the only one guaranteed to be actually hosted (DNS) here; give new users a Spam folder too