domainkeys-milter

I installed dk-filter on gentoo. The MTA is postgres. I test-run it with:
/usr/bin/dk-filter -p local:/var/run/dk-filter/dk-filter.sock -P
/var/run/dk-filter/dk-filter.pid -l -b v -T 10 -h -C "miss=reject" -f

Then i try to send a fake paypal mail. The paypal policy says:
_domainkey.paypal.com. 3600 IN TXT "o=-"

The mail gets delivered, the header says:
Authentication-Results: (myhost); domainkeys=fail (no signature)
header.from=fake@paypal.com

But the mail is not rejected!

I'm not sure if it's a bug or a configuration issue, so i file it here.

Regards, Michael.