DKIM replay explained: what it is and when it matters operationally

dkim

DKIM replay is one of those topics that sounds exotic until you realize the core idea is simple.

An attacker does not forge a new DKIM signature.

They take a message that was already signed legitimately, keep the signed parts intact, and send that same message again to many more recipients than the original sender intended.

That matters because DKIM validates message integrity and signer responsibility for the signed content. It does not prove that a message is fresh, unique, or being delivered only to the audience the sender originally intended.

What DKIM replay actually is

RFC 6376 explicitly calls out replay or spam attacks as a DKIM risk. The model is straightforward: a spammer gets access to a real DKIM-signed message and reuses it at scale so the message still carries a valid signature from a reputable domain.

The key point is this:

  • the signature can still verify
  • the d= domain can still be aligned with the visible From domain
  • DMARC can still pass

So replay is not mainly a cryptographic failure. It is a context failure.

Why a replayed message can still pass DMARC

DMARC does not ask whether a message was intended for the current recipient.

It asks whether at least one supported authentication method produced a pass result on an aligned identifier. RFC 7489 is explicit on that.

If a replayed message keeps a valid aligned DKIM signature, DMARC can still evaluate it as a pass.

That is the same general principle behind multiple DKIM signatures explained: DMARC is about aligned authenticated identifiers, not about the full business legitimacy of the message.

A DKIM pass means the signed content still matches the signer domain. It does not mean the message is fresh, expected, or being sent to the right audience.

What replay looks like in practice

A simple example:

  1. example.com sends a legitimate DKIM-signed announcement.
  2. Someone captures that exact message.
  3. They resend it to a much larger recipient set without changing the signed content.
  4. Receivers still verify the DKIM signature.
  5. If the DKIM d= value aligns with From:, DMARC can still pass.

This is why replay often gets misunderstood.

Admins expect authentication to answer "is this message authorized?" But DKIM only answers a narrower question: "did this signer domain sign these bytes, and are the signed bytes still intact?"

When replay matters operationally

Replay is real, but it is not equally important for every sender.

It matters most when all of these conditions line up:

  • the same message content can be reused broadly
  • the message remains valuable even when resent later
  • the DKIM signature survives redistribution unchanged
  • the attacker can reach many recipients before filters react

That makes replay more relevant for some message classes than others.

Higher-risk situations

  • high-volume broadcast mail where many recipients receive nearly identical content
  • messages whose body stays useful for a while, such as promotions, donation asks, or generic notifications
  • mail streams where recipient-specific data is minimal or absent
  • streams sent from domains with strong reputation, because that reputation can help the replayed mail get more favorable treatment

RFC 6376 section 8.6 specifically notes the attacker is trying to benefit from the signing domain's reputation rather than their own.

Lower-risk situations

  • strongly personalized transactional mail
  • messages that become useless quickly
  • messages where meaningful recipient-specific details are included in the signed content
  • mail flows where additional abuse controls catch unusual volume or targeting quickly

This is why a bank alert containing tightly scoped account-specific details is a different replay story than a generic newsletter blast.

What replay is not

Replay is often mixed up with several other problems.

It is not:

  • a DKIM key compromise
  • a forged DKIM signature
  • ordinary forwarding
  • normal multiple-signature handling

If the private key was stolen, that is a different class of incident entirely. An attacker with the real signing key can generate new signed mail, not just resend old signed mail.

If a mailing list or forwarder redistributes a message and the content changes, that is more in the territory covered by DKIM canonicalization and common breakage and DMARC, forwarding, mailing lists, SPF, DKIM, and ARC.

Why DKIM alone cannot solve freshness

This is the design boundary that matters most.

DKIM was built to let a domain sign selected headers and body content so verifiers can confirm that signed content has not changed. RFC 6376 also says DKIM's signature verifies the hashed content and "asserts nothing else" about protecting end-to-end message integrity.

That means DKIM does not natively answer:

  • was this message originally intended for this recipient?
  • should it still be considered valid now?
  • is this the expected distribution size for this content?

So replay is not some weird exception to DKIM. It is a direct consequence of what DKIM was and was not designed to prove.

The operational question: should you worry a lot?

Usually, replay is not the first thing most domain owners should optimize.

For most teams, bigger risks still come from:

  • incomplete sender inventory
  • broken SPF or DKIM deployment
  • DMARC alignment failures
  • third-party senders using the domain incorrectly

If those basics are not solid yet, fix them first.

Replay becomes more worth focused attention when:

  • you send large volumes of reusable content
  • your brand is attractive for abuse
  • you have seen suspicious complaint spikes or unexpected traffic patterns around specific campaigns
  • mailbox provider feedback suggests abuse of otherwise authenticated mail

Practical ways to reduce replay usefulness

There is no single "set this DNS record" fix for DKIM replay.

The practical goal is to make captured signed mail less reusable and easier to detect when it is abused.

1. Make signed content more recipient- or context-specific

If replayed mail only makes sense for the original recipient, the attacker gets less value from mass reuse.

That does not mean adding random noise. It means signing content that meaningfully ties the message to the intended context, where appropriate.

2. Shorten the useful life of highly sensitive messages

The shorter the message remains valuable, the smaller the replay window.

This is mostly an application and campaign design issue, not a DKIM knob.

3. Watch for sudden bursts of nearly identical authenticated mail

RFC 6376 notes that large verifiers may detect unusually large volumes of mail with the same signature over a short period. Even if you are not a mailbox provider, the operational lesson is still useful: look for abnormal duplication patterns, complaint spikes, and stream-level anomalies.

4. Use reputation and abuse feedback well

The RFC treats reputation systems as a partial mitigation, because they can react when authenticated mail starts behaving like spam. In practice that means complaint monitoring, provider dashboards, and abuse desk signals matter even after SPF, DKIM, and DMARC are working.

5. Be careful with extremely broad, generic signed content

If a message is both widely reusable and highly trusted, it is a better replay candidate.

That does not mean "stop signing newsletters." It means generic high-value content deserves stronger monitoring and stream discipline.

Does key rotation stop replay?

Not cleanly, and not always quickly enough.

RFC 6376 section 8.7 says domains may want to revoke a key when undesirable behavior is detected, including replay abuse. But the RFC also explains the limits:

  • large domains often share keys across many users or systems for operational scale
  • revoking one shared key can affect legitimate traffic too
  • DKIM does not have a neat per-message revocation model

So key rotation is still good hygiene, but it is not a magic replay kill switch. That fits with the broader guidance in DKIM selectors and key rotation playbook and How Often Should You Rotate DKIM Keys?.

A useful mental model for admins

Think of DKIM like a genuine stamp on a document.

The stamp can prove the document was issued by the expected authority and was not altered after stamping.

But if someone photocopies that stamped document and hands it to the wrong crowd, the stamp by itself does not explain whether that redistribution was intended.

That is the operational shape of DKIM replay.

Bottom line

DKIM replay is the reuse of a legitimately signed message, not the forging of a new one.

It matters most for reusable, reputation-bearing mail that can be resent broadly without changing signed content. Because aligned DKIM can still verify, DMARC can still pass on replayed mail.

So the right response is not to expect DKIM to prove freshness. The right response is to treat replay as an abuse-handling problem: reduce how reusable sensitive messages are, monitor for anomalous authenticated traffic, and remember what DKIM is actually designed to guarantee.

Previous Post