opendkim fail | bad RSA signature | verification failed unprotected key

When changing your DNS settings, make sure to update the serial number of the SOA record, ie; 2016092601 ; serial number, where yyyymmddhhvv = year month day hour version. If the serial number doesn't change, some DNS won't update their cache.

Also, make ABSOLUTELY SURE the dkim matches the txt record in your DNS record:

dkim._domainKey TXT ( "p=very-long-text-string")