If you have a Postfix server with TLS enabled, the dkimproxy.out process will also advertise STARTTLS. Use the following option line in the ‘dksign’ section of master.cf to let Postfix ignore it, and fix the long waiting time:
Jason, please consider adding this info to the web page.