fwiw, from Arch wiki https://wiki.archlinux.org/index.php/OpenDKIM "The OpenDKIM daemon does not need to run as root at all (the configuration suggested earlier will have OpenDKIM drop root privileges by itself, but systemd can do this too and much earlier)."
cat /etc/systemd/system/opendkim.service ... [Service] Type=forking User=opendkim Group=postfix ...
