You have finally implemented DKIM (DomainKeys Identified Mail), you might think that your emails are finally safe from being intercepted, but that’s not always the case.

Just because an email passes DKIM authentication doesn’t mean it’s completely safe. Attackers can still grab a valid email and reuse it without changing a thing. Since the DKIM signature stays valid, your system will think the email is legitimate, even though it’s now being misused. This kind of trick is called a DKIM replay attack.

Just as you are constantly fortifying your defences, cybercriminals are also getting smarter. They have now found ways to bypass even the most robust security checks (the ones that you thought were foolproof). The fact of the matter is, no security protocol, no matter how advanced it is, can be fully immune to evolving threats. In other words, we’re not asking you to skip DKIM altogether, simply because it is susceptible to certain types of attacks. DKIM is still an essential weapon in your email security arsenal. What’s important is to identify its gaps and take proactive steps to patch them.

In this article, we will understand what exactly DKIM replay attacks are and how you can mitigate their risks.

What are DKIM Replay Attacks?

In a DKIM replay attack, the attacker does not break your DKIM signature or hack into your system. Instead, they just wait for you to send out an actual email — something as simple as a receipt, a newsletter, or a confirmation message. As soon as that email is sent, it somehow ends up in someone else’s mailbox.

Since they don’t change anything in the message, neither the body nor the subject, the original DKIM signature stays valid. The attacker simply grabs that genuine email and “replays” it by sending it repeatedly to different people. In such cases, the DKIM signature remains intact, which means that mail servers treat it as a genuine, trusted email and pass it through without warning.

This is where the real problem begins. Even though the email is now being misused, your security systems — and the recipients’ email servers — don’t realize anything is wrong because the message still passes DKIM authentication checks. And if you do not put a stop to this in due time, your domains’ deliverability and reputation could face a serious hit.

How do DKIM Replay Attacks Work?

Recently, attackers executed a sophisticated DKIM replay attack using Google’s infrastructure. They sent emails that appeared genuine, passed DKIM validation, and looked like official Google alerts. These emails led victims to fake Google Sites, which replicated legitimate Google pages to steal login credentials.

So, how are such attacks even executed?

Let us take a look at how DKIM replay attacks work:

DKIM Signature Flexibility

The primary reason that DKIM replay attacks can make their way through your email ecosystem is the flexibility that DKIM signatures offer. By flexibility, we do not mean that signatures can be easily changed, but the freedom to change the domain in the “From” header. So, to the recipient, it might seem like the email is from a trusted source when, in reality, it’s coming from a different, potentially malicious domain.

DKIM Verification

Once the mail server receives the mail (with the altered “From” address and a valid DKIM signature), it checks the private DKIM key against the key published in your DNS records. If the signature matches, the server lets the email in, even if the “From” address looks like it’s from a different domain.

Aiming for Reputable Domains

If an attacker hacks into someone’s email account or creates an email address under a domain that email servers already trust, they can use that trust to their advantage. Since email servers already believe messages from that domain are safe, they won’t look too closely. As a result, the attacker can replay emails without raising any red flags, making it much easier to fool people.

Sending a Harmless Email

Once the attacker has access to a trusted email account — or creates one under a domain that’s seen as safe — they send a basic email from it. This email doesn’t have to be anything fancy or overtly professional. It could be a blank message, a newsletter, or a simple confirmation. The point is to send a real email that gets signed with a valid DKIM signature. That’s all they need to start the attack.

Sending It All Over Again

Now comes the main attack. After sending a seemingly harmless email, the attacker starts sending it again and again, to different people, groups, or even to public mailing lists. Since nothing in the email has changed and the DKIM signature is still valid, most email servers treat it like a genuine message.

How to Defend Against DKIM Replay Attacks?

Now that you know how attackers operate, you should leverage that information to stay a step ahead of them and protect your domain. Here’s how you can do that:

For email senders

• Make sure you sign not just the basic parts of the email, but also key fields like “Date,” “Subject,” “From,” “To,” and “CC.” This locks them down so no one can change them after the email is sent.
• Keep your DKIM signatures valid for only a short time. The shorter the expiry window, the less time attackers have to replay your emails.
• Add timestamps and random numbers (nonces) in your email headers or body. This makes every email slightly unique and much harder for attackers to resend successfully.
• Change your DKIM signing keys every few months (or more often, if possible). This ensures that even if a threat actor compromises a key, they can’t exploit it for long.

For email receivers

• Set limits on the number of emails you accept from the same sender in a given time period to detect and block suspicious replay attempts.
• Monitor and block traffic from suspicious IP addresses to prevent malicious replay attacks.

Liked what you just read?

Hi, I’m Daksh Kaur, a freelance cybersecurity writer with a knack for turning complex topics into clear, actionable insights.

Reach me at daksh@turtlewords.com and let’s work together to make the blog section of your website a go-to resource for your clients.