With UseSSP set to Yes, dkim-filter returns a "554 5.7.1 Command rejected".
I suggest using a 550 reply code for policy decisions such as SSP. It may be better to set the default reply text as "rejected per sender domain policy" as "Command rejected" isn't informative.
Proposed patch #1
Logged In: YES
user_id=1048957
Originator: NO
Try the attached patch.
File Added: PATCH
Logged In: YES
user_id=1048957
Originator: NO
v2.4.0 released, containing this patch.