Many people have written about DKIM header injection attacks.  The suggestion to mitigate it is to oversign headers and to rotate any DKIM keys that were previously used to sign e-mails where not all important headers have been oversigned.
Essentials and obvious things first. If the e-mail uses a headers such as
Subject:etc, then these headers must be signed.
For better security, such header actually included in the e-mail have to be signed again. That is called DKIM oversigning. "Signed again" here means adding it again to the
h=field of the DKIM signature. So when someone views the e-mail headers, they see
Subject:etc are signed (in the
h=list) two times. This is because otherwise if that wasn't the case then a spammer might inject that header as an additional malicious header.
For other headers for example a header such as
List-Unsubscribethat is usually not included unless the e-mail was sent by a mailing list, it should be oversigned anyhow. I.e. also added to the the
h=field. But adding the header to the
h=field only once is sufficient. There's no additional security by oversigning the header two, three more or even more times. That's because that way it has already been unambiguously expressed that this header didn't exist in the original e-mail. 
Maybe headers such as for example
List-Unsubscribearen't too important for non-mailinglists but as defense in depth, why not add it anyway? It makes the
h=(headers) part of the DKIM signature longer but most users are not looking at it anyhow so why not.
Is my understanding so far correct?
Elsewhere I am reading:
Normal headers: they are signed as many times as you specify them.
Why would a header be signed let's say 3 times? Ok, when using a header twice legitimately in the original then signing it twice plus one more time (oversign) so 3 times in total makes sense.
But if a header is included only once, signing it 2 times makes sense. But signing it 3 times, seems unnecessary? At best, does nothing. At worst, confuses DKIM verification software or breaks maximum string length settings or something.
 Technically because the header is not in the original e-mail. It's only in a list of the
h= field in the DKIM signature. The DKIM signature can only be verified if no part of headers covered by the DKIM signature has been modified. Adding this header even though it was already oversigned (which means it was added to the
h= field even though the original e-mail didn't include it) would result in DKIM signature verification failure.