--- title: "Bypassing DKIM: Understanding replay attacks and how to mitigate them | DuoCircle" description: "Bypassing DKIM: Understanding replay attacks and how to mitigate them." image: "https://www.duocircle.com/images/og-default.png" canonical: "https://www.duocircle.com/blog/email-security/bypassing-dkim-understanding-replay-attacks-and-how-to-mitigate-them/" --- Quick Answer A DKIM replay attack reuses a valid, originally-signed message to deliver new content or new recipients without breaking the signature. The attacker captures or generates a legitimate DKIM-signed message from a high-reputation domain, then re-broadcasts the same message to thousands of recipients. Because the DKIM signature remains valid, receiving servers accept the message. Gmail in particular weights domain reputation heavily, which makes replayed messages from trusted domains hard to filter. The defenses split between sender and receiver. Senders should over-sign critical headers (Date, Subject, From, To, CC) so they cannot be modified, set short expiration times via the x= tag to bound the replay window, include timestamps and nonces so re-sending later breaks verification, and rotate DKIM keys regularly to limit any single key's exposure. Receivers should rate-limit incoming mail per sending domain and block traffic from IPs already associated with known abuse. None of these alone close the gap; together they shrink the attack window enough that replay is no longer cheap. Bypassing DKIM: Understanding replay attacks and how to mitigate them Your browser does not support the audio element. [ Download episode](https://media.mailhop.org/duocircle/images/2025/04/Bypassing-DKIM-Understanding-replay-attacks-and-how-to-mitigate-them.mp3) Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Femail-security%2Fbypassing-dkim-understanding-replay-attacks-and-how-to-mitigate-them%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=Bypassing%20DKIM%3A%20Understanding%20replay%20attacks%20and%20how%20to%20mitigate%20them&url=undefined%2Fblog%2Femail-security%2Fbypassing-dkim-understanding-replay-attacks-and-how-to-mitigate-them%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Femail-security%2Fbypassing-dkim-understanding-replay-attacks-and-how-to-mitigate-them%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Femail-security%2Fbypassing-dkim-understanding-replay-attacks-and-how-to-mitigate-them%2F&title=Bypassing%20DKIM%3A%20Understanding%20replay%20attacks%20and%20how%20to%20mitigate%20them "Share on Reddit") [ ](mailto:?subject=Bypassing%20DKIM%3A%20Understanding%20replay%20attacks%20and%20how%20to%20mitigate%20them&body=Check out this article: undefined%2Fblog%2Femail-security%2Fbypassing-dkim-understanding-replay-attacks-and-how-to-mitigate-them%2F "Share via Email") ![replay attacks](https://media.mailhop.org/duocircle/images/2025/04/sender-policy-framework-4452.jpg) Threat actors always try to stay ahead of the curve and find ways to bypass security protocols. [DKIM replay attacks](/email-security/dkim-replay-attack-a-new-cyberthreat/) are exactly that. In a DKIM replay attack, a cybercriminal resends a **DKIM-signed message** to multiple recipients without the emails getting flagged. They generally target highly reputed domains to generate legitimate message signatures. Gmail recipients, in particular, are more likely to receive replayed emails because it greatly prioritizes domain reputation. This blog explores how DKIM replay attacks are attempted and **how you can mitigate** them. ## What is a DKIM replay attack? In a DKIM replay cyberattack, a malicious actor intercepts a [legitimate email](https://www.trendmicro.com/vinfo/us/security/definition/legitimate-bulk-emails) that was **originally signed and sealed** using DKIM. Then, they resend or ‘replay’ the same email with some alterations, which passes DKIM checks and tricks recipients into believing that it’s a safe message. When the recipient’s mail server receives this kind of email, it finds no discrepancies, as the original [DKIM signature](https://docs.mapp.com/v1/docs/dkim-signature) remains unchanged and valid. That’s exactly how many [malicious emails](https://www.securitymagazine.com/articles/100687-the-last-six-months-shows-a-341-increase-in-malicious-emails) end up in inboxes. _Adversaries exploit intercepted keys, allowing them to add a new header or tweak subject lines according to their intentions_. The keys are usually intercepted using [man-in-the-middle attack](https://www.securityweek.com/high-severity-openssl-vulnerability-found-by-apple-allows-mitm-attacks/) techniques. ## How does a DKIM replay attack work? A DKIM replay attack is a **four-step process**. ### DKIM signature flexibility [DKIM](/resources/what-is-dkim) authentication doesn’t require the **signing domain** and the domain in the ‘From’ header to be the same. This allows [threat actors](https://www.scworld.com/news/threat-actor-using-vishing-ms-quickassist-and-teams-can-potentially-drop-ransomware) to send emails from different domains without getting flagged. [![Threat Actors](https://media.mailhop.org/duocircle/images/2025/04/sendgrid-alternative-4535.jpg)](https://media.mailhop.org/duocircle/images/2025/04/sendgrid-alternative-4535.jpg) ### DKIM verification When [email servers](https://www.one.com/en/email/what-is-an-email-server) receive emails, they check the DKIM signature to verify if the email content was altered in transit. If the **signature is validated** as authorized, the email passes the checks. ### Targeting domains with a high reputation [Cybercriminals](https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/back-to-the-hype-an-update-on-how-cybercriminals-are-using-genai) gain access to reputed domains and then plan the attack by replaying the captured emails hundreds and thousands of times. They may even **create a new domain**. ### Sending the first email After gaining access to or **establishing a reputable domain**, the adversary sends emails from the compromised domain to another mailbox they control. The initial email is typically legitimate and harmless, ensuring it does not arouse any suspicion. ### Rebroadcasting Lastly, attackers use the captured **email and re-broadcast** the same message to different recipients. Since the email has a valid DKIM signature, receiving [mail servers](https://www.cloudflare.com/learning/email-security/what-is-a-mail-server/) place them in the inboxes. [![cyber actors](https://media.mailhop.org/duocircle/images/2025/04/spf-validator-4452.jpg)](/email-security/bypassing-dkim-understanding-replay-attacks-and-how-to-mitigate-them/attachment/online-and-phone-fraud-computer-hacker-thief-man-scam-in-social-media-cheating-on-internet-covert-crime-swindler-cybercrime-data-hacking-danger-of-stealing-money-personal-information-vector) ## Preventing DKIM replay attacks Here’s what email senders can do to prevent DKIM replay attacks- 1. Over-sign headers so that Date, Subject, From, To, and CC can’t be modified. 2. _Set short expiration times (x=) to reduce the window of opportunity for replay attacks_. 3. Include timestamps and nonces (random numbers) so that it becomes challenging for threat actors to resend the same email after some time because the values would get changed. 4. Rotate your [DKIM keys](/email-security/best-practices-to-follow-for-managing-dkim-keys/) regularly so that [cyber actors](https://www.cybersecuritydive.com/news/iran-cyberattacks-us-critical-infrastructure/725877/) can’t exploit them for too long, even if they are compromised. Here’s what recipients can do to prevent being victims of DKIM replay attacks- 1. **Implement a rate limit** on incoming emails so that attackers don’t overload your mailboxes. 2. Practice network security measures to detect and block traffic from IP addresses and sources involved in [malicious activities](https://thehackernews.com/2024/12/researchers-uncover-4-month-cyberattack.html). Managing email authentication protocols requires constant effort. You must evaluate insights offered by [DMARC aggregate and forensic reports](/resources/dmarc-aggregate-report) that help you know if [SPF](https://autospf.com/blog/spf-guide-understanding-sender-policy-framework/), DKIM, and [DMARC records](/resources/create-dmarc-records) require some adjustments. This isn’t as easy as it **sounds and demands** technical expertise. So, if you are looking for someone to give your [email authentication](/resources/email-authentication) worries to, then contact [DuoCircle](/). We take care of everything, right from implementation to evaluation to adjustments. ## Topics DKIMDMARCSecurityspf ![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) Brad Slavin General Manager General Manager at DuoCircle. Product strategy and commercial lead across the email security portfolio. ## Secure your email infrastructure Protect, authenticate, and deliver. Contact our team to find the right solution. [Contact Sales](/contact/) [Explore Products](/products/) ## Related Articles [ Email Security 12m DMARC, SPF, and DKIM in 2026: Why Email Authentication Is Now a Regulatory Requirement, Not Just a Best Practice Apr 29, 2026 ](/blog/dmarc-spf-dkim-2026-email-authentication-regulatory-requirement-best-practice/)[ Email Security 5m Email Monitoring Tools: A Complete Guide to Protecting Your Email Ecosystem May 7, 2026 ](/blog/email-monitoring-tools-guide-protecting-your-email-ecosystem-security/)[ Email Security 6m 3 emerging AI-powered cyber threats and how to stay protected from them in 2025 Jun 27, 2025 ](/blog/email-security/3-ai-powered-cyber-threats-2025-and-how-to-stay-safe/)[ Email Security 6m 5 efficient email security techniques for advanced persistent threats Dec 3, 2024 ](/blog/email-security/5-efficient-email-security-techniques-for-advanced-persistent-threats/) ```json {"@context":"https://schema.org","@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}],"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://www.g2.com/products/phish-protection-by-duocircle/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://support.duocircle.com"},"knowsAbout":["Email Security","Email Authentication","SPF","DKIM","DMARC","Phishing Protection","Spam Filtering","SMTP Relay","Email Deliverability","Email Forwarding"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"DuoCircle LLC","url":"https://www.duocircle.com","description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}} ``` ```json [{"@context":"https://schema.org","@type":"BlogPosting","headline":"Bypassing DKIM: Understanding replay attacks and how to mitigate them","description":"Bypassing DKIM: Understanding replay attacks and how to mitigate them.","url":"https://www.duocircle.com/blog/email-security/bypassing-dkim-understanding-replay-attacks-and-how-to-mitigate-them/","datePublished":"2025-04-03T14:24:53.000Z","dateModified":"2025-04-07T18:20:30.000Z","dateCreated":"2025-04-03T14:24:53.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/email-security/bypassing-dkim-understanding-replay-attacks-and-how-to-mitigate-them/"},"articleSection":"email-security","keywords":"DKIM, DMARC, Security, spf","wordCount":605,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2025/04/sender-policy-framework-4452.jpg","caption":"replay attacks","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":2,"name":"Email Security"},{"@type":"ListItem","position":3,"name":"Bypassing DKIM: Understanding replay attacks and how to mitigate them","item":"https://www.duocircle.com/blog/email-security/bypassing-dkim-understanding-replay-attacks-and-how-to-mitigate-them/"}]}] ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://www.duocircle.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":3,"name":"Email Security","item":"https://www.duocircle.comundefined"},{"@type":"ListItem","position":4,"name":"Bypassing DKIM: Understanding replay attacks and how to mitigate them","item":"https://www.duocircle.com/blog/email-security/bypassing-dkim-understanding-replay-attacks-and-how-to-mitigate-them/"}]} ``` ```json {"@context":"https://schema.org","@type":"BlogPosting","headline":"Bypassing DKIM: Understanding replay attacks and how to mitigate them","description":"Bypassing DKIM: Understanding replay attacks and how to mitigate them.","url":"https://www.duocircle.com/blog/email-security/bypassing-dkim-understanding-replay-attacks-and-how-to-mitigate-them/","datePublished":"2025-04-03T14:24:53.000Z","dateModified":"2025-04-07T18:20:30.000Z","dateCreated":"2025-04-03T14:24:53.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/email-security/bypassing-dkim-understanding-replay-attacks-and-how-to-mitigate-them/"},"articleSection":"email-security","keywords":"DKIM, DMARC, Security, spf","wordCount":605,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2025/04/sender-policy-framework-4452.jpg","caption":"replay attacks","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}} ```