diff -U4 -r exim-4.69/doc/experimental-spec.txt exim-4.69+domainkeys-nosign/doc/experimental-spec.txt
--- exim-4.69/doc/experimental-spec.txt	2007-10-04 14:21:06.000000000 +0100
+++ exim-4.69+domainkeys-nosign/doc/experimental-spec.txt	2008-01-26 10:09:06.000000000 +0000
@@ -405,8 +405,13 @@
     you are doing. The result of the string expansion is  also
     put in $dk_domain.
 
 
+  dk_sign = <condition> [OPTIONAL]
+
+    This option makes it possible to disable the whole signing
+    process in advance since dk_private_key cannot be expanded
+    until the message has been read. Defaults to "true".
 
 
 2. Brightmail AntiSpam (BMI) suppport
 --------------------------------------------------------------
diff -U4 -r exim-4.69/src/transports/smtp.c exim-4.69+domainkeys-nosign/src/transports/smtp.c
--- exim-4.69/src/transports/smtp.c	2007-09-28 13:21:57.000000000 +0100
+++ exim-4.69+domainkeys-nosign/src/transports/smtp.c	2008-01-26 10:09:06.000000000 +0000
@@ -49,8 +49,10 @@
   { "dk_private_key", opt_stringptr,
       (void *)offsetof(smtp_transport_options_block, dk_private_key) },
   { "dk_selector", opt_stringptr,
       (void *)offsetof(smtp_transport_options_block, dk_selector) },
+  { "dk_sign", opt_stringptr,
+      (void *)offsetof(smtp_transport_options_block, dk_sign) },
   { "dk_strict", opt_stringptr,
       (void *)offsetof(smtp_transport_options_block, dk_strict) },
 #endif
 #ifdef EXPERIMENTAL_DKIM
@@ -214,8 +216,9 @@
   NULL,                /* dk_domain */
   NULL,                /* dk_headers */
   NULL,                /* dk_private_key */
   NULL,                /* dk_selector */
+  US"true",            /* dk_sign */
   NULL                 /* dk_strict */
   #endif
   #ifdef EXPERIMENTAL_DKIM
  ,NULL,                /* dkim_canon */
@@ -1595,9 +1598,10 @@
   DEBUG(D_transport|D_v)
     debug_printf("  SMTP>> writing message and terminating \".\"\n");
   transport_count = 0;
 #ifdef EXPERIMENTAL_DOMAINKEYS
-  if ( (ob->dk_private_key != NULL) && (ob->dk_selector != NULL) )
+  if ( (ob->dk_private_key != NULL) && (ob->dk_selector != NULL)
+      && expand_check_condition(ob->dk_sign, US"dk_sign", US"option") )
     ok = dk_transport_write_message(addrlist, inblock.sock,
       topt_use_crlf | topt_end_dot | topt_escape_headers |
         (tblock->body_only? topt_no_headers : 0) |
         (tblock->headers_only? topt_no_body : 0) |
diff -U4 -r exim-4.69/src/transports/smtp.h exim-4.69+domainkeys-nosign/src/transports/smtp.h
--- exim-4.69/src/transports/smtp.h	2007-09-28 13:21:57.000000000 +0100
+++ exim-4.69+domainkeys-nosign/src/transports/smtp.h	2008-01-26 10:09:06.000000000 +0000
@@ -57,13 +57,14 @@
   uschar *tls_verify_certificates;
   BOOL    tls_tempfail_tryclear;
   #endif
   #ifdef EXPERIMENTAL_DOMAINKEYS
+  uschar *dk_canon;
   uschar *dk_domain;
+  uschar *dk_headers;
   uschar *dk_private_key;
   uschar *dk_selector;
-  uschar *dk_canon;
-  uschar *dk_headers;
+  uschar *dk_sign;
   uschar *dk_strict;
   #endif
   #ifdef EXPERIMENTAL_DKIM
   uschar *dkim_domain;