diff --git a/CHANGES b/CHANGES
index 5921b75..676f4d3 100644
--- a/CHANGES
+++ b/CHANGES
@@ -13,6 +13,8 @@
  - Added support for AuthservID option
  - Added support for InternalHosts option (ipaddress and either dns (dnspython)
    or pydns (DNS) modules are now required)
+ - Added support for DiagnosticDirectory and updated dkimpy-milter specifics in
+   dkimpy-milter.conf.5
 
 0.9.3 2018-03-02
  - Fixup csl dataset processing for single item lists
diff --git a/TODO b/TODO
index 233d543..b500c2e 100644
--- a/TODO
+++ b/TODO
@@ -30,11 +30,12 @@ File dataset           implemented      verified
 
 0.9.4 (Alpha)
 AuthservID      implemented     verified
+DiagnosticDirectory     implemented     verified
 InternalHosts   implemented     verified
 
 0.9.5 (Beta)
-Diagnostics
-DiagnosticDirectory
+
+
 SyslogSuccess
 
 1.0.0
@@ -60,6 +61,7 @@ SignatureAlgorithm
 Later
 
 BaseDirectory
+Diagnostics (requires dkimpy changes)
 DontSignMailTo
 ExemptDomains
 ExternalIgnoreList
diff --git a/dkimpy_milter/__init__.py b/dkimpy_milter/__init__.py
index d145799..a8d1261 100644
--- a/dkimpy_milter/__init__.py
+++ b/dkimpy_milter/__init__.py
@@ -247,11 +247,14 @@ class dkimMilter(Milter.Base):
                   syslog.syslog('DKIM: Pass ({0})'.format(d.domain))
               self.dkim_domain = d.domain
           else:
-            fd,fname = tempfile.mkstemp(".dkim")
-            with os.fdopen(fd,"w+b") as fp:
-                fp.write(txt)
-            if milterconfig.get('Syslog'):
-                syslog.syslog('DKIM: Fail (saved as {0})'.format(fname))
+              if milterconfig.get['DiagnosticDirectory']:
+                  fd,fname = tempfile.mkstemp(".dkim")
+                  with os.fdopen(fd,"w+b") as fp:
+                      fp.write(txt)
+                  if milterconfig.get('Syslog'):
+                      syslog.syslog('DKIM: Fail (saved as {0})'.format(fname))
+              else:
+                  syslog.syslog('DKIM: Fail ({0})'.format(d.domain))
           if res:
             result = 'pass'
           else:
diff --git a/dkimpy_milter/config.py b/dkimpy_milter/config.py
index a86ffb4..0e276e3 100644
--- a/dkimpy_milter/config.py
+++ b/dkimpy_milter/config.py
@@ -46,7 +46,8 @@ defaultConfigData = {
         'UserID' : 'dkimpy-milter',
         'Canonicalization' : 'relaxed/simple',
         'InternalHosts' : '127.0.0.1',
-        'InternalHostsObj' : False
+        'InternalHostsObj' : False,
+        'DiagnosticDirectory' : ''
         }
 
 
@@ -334,6 +335,7 @@ def _readConfigFile(path, configData = None, configGlobal = {}):
         'Canonicalization' : 'str',
         'InternalHosts' : 'dataset',
         'InternalHostsObj': 'bool',
+        'DiagnosticDirectory' : 'str'
             }
 
     #  check to see if it's a file
diff --git a/man/dkimpy-milter.conf.5 b/man/dkimpy-milter.conf.5
index 89dac06..ba8559d 100644
--- a/man/dkimpy-milter.conf.5
+++ b/man/dkimpy-milter.conf.5
@@ -215,18 +215,12 @@ The value may include two different canonicalizations separated by a
 slash ("/") character, in which case the first will be applied to the
 header and the second to the body.
 
-.TP
-.I Diagnostics (Boolean)
-Requests the inclusion of "z=" tags in signatures, which encode the
-original header field set for use by verifiers when diagnosing verification
-failures.  Not recommended for normal operation. [dkimpy-milter specific: also
-increases the verbosity of Syslog logging if enabled.]
-
 .TP
 .I DiagnosticDirectory (string)
 Directory into which to write diagnostic reports when message verification
-fails on a message bearing a "z=" tag.  If not set (the default), these files
-are not generated.
+fails.  If not set (the default), these files are not generated.  [Unlike
+OpenDKIM, this applies to all messages, not just  on messages bearing a "z=" tag
+because dkimpy does not yet support "z=".]
 
 .TP
 .I Domain (dataset)