diff --git a/CHANGES b/CHANGES
index 80bae87..40326a9 100644
--- a/CHANGES
+++ b/CHANGES
@@ -8,6 +8,8 @@
  - Install openrc init file for Gentoo and other openrc users
  - Add support for passing PID file name on command line to make it easier to
    keep system init and daemon configuration in sync
+ - Add support for storing DKIM failed mails in a specified
+   DiagnosticDirectory
  - Fix startup logging so it provides information at a useful time
  - Fix verify processing so missing (optional) i= tag doesn't cause the milter
    to fail  (LP: #1842250)
diff --git a/TODO b/TODO
index e2dd7ff..9ae93ec 100644
--- a/TODO
+++ b/TODO
@@ -56,7 +56,7 @@ KeytableEd25519     implemented  verified
 MinimumKeyBits      implemented  verified
 SignHeaders	    implemented  verified by inspection
 SigningTable        implemented  verified
-TemporaryDirectory
+TemporaryDirectory  implemented  verified by inspection
 
 Planned dataset type support (if needed):
 mdb:
diff --git a/dkimpy_milter/__init__.py b/dkimpy_milter/__init__.py
index 73a94f0..7975732 100644
--- a/dkimpy_milter/__init__.py
+++ b/dkimpy_milter/__init__.py
@@ -413,6 +413,7 @@ class dkimMilter(Milter.Base):
                 self.dkim_domain = d.domain.lower()
             else:
                 if self.conf.get('DiagnosticDirectory'):
+                    tempfile.tempdir = self.conf.get('DiagnosticDirectory')
                     fd, fname = tempfile.mkstemp(".dkim")
                     with os.fdopen(fd, "w+b") as fp:
                         fp.write(txt)
diff --git a/man/dkimpy-milter.conf.5 b/man/dkimpy-milter.conf.5
index 28e10a2..2506865 100644
--- a/man/dkimpy-milter.conf.5
+++ b/man/dkimpy-milter.conf.5
@@ -211,9 +211,11 @@ header and the second to the body.
 .TP
 .I DiagnosticDirectory (string)
 Directory into which to write diagnostic reports when message verification
-fails.  If not set (the default), these files are not generated.  [Unlike
-OpenDKIM, this applies to all messages, not just  on messages bearing a "z=" tag
-because dkimpy does not yet support "z=".]
+fails.  If not set (the default), these files are not generated.  The
+directory must exist, dkimpy-milter will not create it and an error will be
+raised if it does not.  [Unlike OpenDKIM, this applies to all messages, not
+just  on messages bearing a "z=" tag because dkimpy does not yet support
+"z=" processing.]
 
 .TP
 .I Domain (dataset)
diff --git a/man/dkimpy-milter.conf.5.in b/man/dkimpy-milter.conf.5.in
index f1f40f1..30eaecd 100644
--- a/man/dkimpy-milter.conf.5.in
+++ b/man/dkimpy-milter.conf.5.in
@@ -211,9 +211,11 @@ header and the second to the body.
 .TP
 .I DiagnosticDirectory (string)
 Directory into which to write diagnostic reports when message verification
-fails.  If not set (the default), these files are not generated.  [Unlike
-OpenDKIM, this applies to all messages, not just  on messages bearing a "z=" tag
-because dkimpy does not yet support "z=".]
+fails.  If not set (the default), these files are not generated.  The
+directory must exist, dkimpy-milter will not create it and an error will be
+raised if it does not.  [Unlike OpenDKIM, this applies to all messages, not
+just  on messages bearing a "z=" tag because dkimpy does not yet support
+"z=" processing.]
 
 .TP
 .I Domain (dataset)