Relaxed in DKIM allows for non signficant changes in headers (ex case of the header names, extraneous whitespace, line folding) and for changes in trailing whitespace in the body. Headers and body are configured separately, but relaxed/relaxed ends up being fairly necessary.
What you want to look at is their DMARC record:
v=DMARC1; p=reject; rua=mailto:[email protected]; ruf=mailto:[email protected]
If your mail server receives an email that claims to be from paypal.com, but it's not dkim signed (by paypal.com) it should be rejected.
But even paypal.com, likely one of the top phisher targets publishes their DKIM signature with: DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mail.paypal.com;
I'm surprised that even internal email systems inside of companies regularly accept email from allegedly inside the company, that are forgeries. You'd think ibm.com (just an example) would A) sign ALL outgoing email B) check DKIM for all incoming email C) reject anything claiming ibm.com, but without the ibm.com signature.
Seems insane that it's so easy to send email as a companies/organizations management.