diff --git a/cmdeploy/src/cmdeploy/opendkim/final.lua b/cmdeploy/src/cmdeploy/opendkim/final.lua
index 2779e38d..37f36354 100644
--- a/cmdeploy/src/cmdeploy/opendkim/final.lua
+++ b/cmdeploy/src/cmdeploy/opendkim/final.lua
@@ -31,7 +31,7 @@ end
 if valid then
 	-- Strip all DKIM-Signature headers after successful validation
 	-- Delete in reverse order to avoid index shifting.
-	for i = nsigs, 1, -1 do
+	for i = nsigs - 1, 0, -1 do
 		odkim.del_header(ctx, "DKIM-Signature", i)
 	end
 else