message headers say dkim = fail, stats say = PASSED. why the conflict, and how to fix?

Jason, is it possible for you to change the c=simple/simple to c=relaxedrelaxed? I seen a lot of times where different DKIM Validators struggle with the whitespace folding. You say it's only failing with "Bulk", so that tells me you are sending this out through some SMTP Service, which makes me more inclined to believe the headers are being rewritten and the whitespace folding of simple/simple is the culprit. You can also run Mail Test on it, which will test it with 4 different DKIM validator - If it fails all four. It's probably what's going on, when you send through that bulk service.

Updated Section Below

Since your receiving the email, you can still re-process it and check the DKIM with another validator. This is what I do for sanity checks when I think my email server might be processing DKIM wrong. I'm using Limilabs Mail.dll to do handle the sending of the EML, but you can use whatever you want, in whatever programming language you're familiar with. DKIM stays intact and you'll be able to validate it against other DKIM Validators using online auto-responders.

    Dim email As IMail
    Dim mb As New Limilabs.Mail.MailBuilder
    Dim smtpMail As SmtpMail = SmtpMail.CreateFromEmlFile("D:ValidateDKIMBadDKIM.eml")
    email = mb.CreateFromEml(smtpMail.RawEmlData)

     Using client As New Smtp()
            client.ConnectSSL("mailserver", 465)
            client.Login("mailserver", "password")
            Dim stream As System.Net.Security.SslStream = client.ReadStream()

            Dim reader As IO.StreamReader = New IO.StreamReader(stream)
            client.SendMessage(New SmtpMail("Mail Check", { "[email protected]","[email protected]"}, smtpMail.RawEmlData))
            client.Close()
    End Using