See also issue 34277 for a previous discussion.

I thought I had included a header-level toggle for encoded words, but that doesn't actually make sense, since by default a header value is treated as unstructured (which means encoded words are allowed).

To implement this you need to add a new TokenList class to _header_value_parser, say DKIMHeaderValue, with the class attribute 'as_ew_allowed' set to False.

Do you have a BNF description of the DKIM header?  I could probably sketch the implementation of the DKIM header value parser from that.

Then you create a header in headerregistry that uses that parser as its value_parser.