---
title: "DKIM Replay Attack- A New Cyberthreat | DuoCircle"
description: "DKIM Replay Attack- A New Cyberthreat."
image: "https://www.duocircle.com/images/og-default.png"
canonical: "https://www.duocircle.com/blog/email-security/dkim-replay-attack-a-new-cyberthreat/"
---

Quick Answer

A DKIM replay attack is when an attacker captures a legitimately DKIM-signed message from a reputable domain and resends it to large numbers of new recipients. Because the original DKIM signature is still valid, receiving servers see DKIM=pass and route the message to the inbox. Attackers obtain the original signed message by compromising a mailbox, intercepting traffic, or in some cases generating valid signatures from a domain they have access to. They can change the subject line and add headers without breaking the signature, which lets them deliver the same payload at scale while looking authenticated. Mitigations include rotating DKIM keys on a tighter cadence (every three to six months for higher-risk domains), pairing DKIM with SPF and DMARC so the From domain alignment check still applies, and rate-limiting outbound volume to detect anomalous spikes.

DKIM Replay Attack- A New Cyberthreat

Your browser does not support the audio element.

[ Download episode](https://media.mailhop.org/duocircle/images/2024/05/DKIM-Replay-Attack-A-New-Cyberthreat-.mp3) 

Share 

[ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Femail-security%2Fdkim-replay-attack-a-new-cyberthreat%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=DKIM%20Replay%20Attack-%20A%20New%20Cyberthreat&url=undefined%2Fblog%2Femail-security%2Fdkim-replay-attack-a-new-cyberthreat%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Femail-security%2Fdkim-replay-attack-a-new-cyberthreat%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Femail-security%2Fdkim-replay-attack-a-new-cyberthreat%2F&title=DKIM%20Replay%20Attack-%20A%20New%20Cyberthreat "Share on Reddit") [ ](mailto:?subject=DKIM%20Replay%20Attack-%20A%20New%20Cyberthreat&body=Check out this article: undefined%2Fblog%2Femail-security%2Fdkim-replay-attack-a-new-cyberthreat%2F "Share via Email") 

![Cyberthreat](https://media.mailhop.org/duocircle/images/2024/05/spf-record-check-7315.jpg) 

In DKIM replay attacks, bad actors exploit **highly reputed email domains** and produce legitimate DKIM keys corresponding to them. The produced keys are then used to **bypass DKIM filters** and compromise the [online security](/email-security/online-security-awareness-training-a-necessity-in-todays-digital-age/) of thousands of recipients. All this is possible because, upon reception, the recipients’ mail servers find no discrepancies in [DKIM](/resources/what-is-dkim) authentication; hence, the emails are placed in the [primary inboxes](https://mailmeteor.com/glossary/primary-folder).

_Playing with illegitimately produced or intercepted [DKIM keys](/email-hosting/what-is-dkim-and-why-you-should-use-it-to-secure-your-email/) even allows hackers to add a new header or make changes in the subject line so as to send **customized emails** to recipients._ This way, they land in the inboxes of more people and harm them.

What’s worse is that your **sender’s reputation** will also suffer, which means even genuine messages sent by one of your official brand representatives will be marked as spam or [bounced back](https://www.activecampaign.com/blog/email-bounce). The integrity of your domain will be in question. 

## What is a DKIM Replay Attack?

DKIM replay attack is an [email-based cyberattack](https://www.bbc.com/news/uk-england-kent-68284475) in which a threat actor exploits the DKIM authentication mechanism by intercepting a legitimate email signed with DKIM. _Once captured, the **email is resent hundreds and thousands of times** by changing the subject line and email header_. Interception is done by compromising email accounts, using [man-in-the-middle techniques](https://en.wikipedia.org/wiki/Man-in-the-middle%5Fattack), or gaining access to mail servers.

Since the original **DKIM signature remains intact and valid**, the email appears legitimate and thus bypasses the [email filtering service](/content/email-filtering-service). 

[![phishing statistics 2024](https://media.mailhop.org/duocircle/images/2024/05/email-sending-services.jpg)](https://media.mailhop.org/duocircle/images/2024/05/email-sending-services.jpg)

## How Does a DKIM Replay Attack Work?

A DKIM replay **attack unfolds** in the following stages-

### DKIM Signature Flexibility

_DKIM doesn’t care if the signing domain and the domain mentioned in the ‘From’ header are the same or not_. Because of this indifference, emails sent from a specific domain in the ‘From’ header can be linked with a [DKIM signature](/email-security/canonicalization-reason-behind-dkim-signature-verification-failures/) of another domain **without raising any technical issues**. 

### DKIM Verification

When an email is received, the email servers are responsible for checking the DKIM signature and verifying whether the **email content was tampered** with in transit. When the signature is validated as authorized, the authorization result is shown as ‘pass.’ 

### Exploiting Highly Reputed Domains

In the attacking stage, the adversary gains illegitimate access to the target’s mailbox, which is associated with a [reputed domain](https://www.spamhaus.org/resource-hub/domain-reputation/a-beginners-guide-to-domain-reputation-what-is-it/#lessstronggreaterso-how-do-you-maintain-your-domain-reputationlessstronggreater). Then, they plan the attack by replaying the captured email. In some instances, they **even create a new domain**. 

### Sending the Initial Email

After exploiting or creating a reputed domain, the [adversary sends emails](https://thehackernews.com/2024/05/apt42-hackers-pose-as-journalists-to.html) from the intercepted domain to another mailbox controlled by them. The **initial message** generally has no ill intentions and is legitimate, so no suspicion is raised at all. 

### Re-Broadcasting

Finally, the threat actor re-broadcasts the captured email to other targeted recipients. The **signature is preserved** to be used for other attacks or to continue communication with the current target, strategically fooling them into giving in [sensitive details](https://cybersecuritynews.com/dell-hacked/), [downloading malware-infected files](https://cybersecuritynews.com/danabot-malware-via-weaponized-word-files/), or making financial transactions. 

## Mitigation Strategies

Steering clear of DKIM replay attacks is possible for domain owners if they **practice the following**\-

### DKIM Key Rotation

[Regularly rotating DKIM keys](https://dmarcreport.com/blog/how-often-should-you-rotate-your-dkim-keys/) can limit the usefulness of intercepted DKIM-signed emails, reducing the window of opportunity for replay attacks. While there is no one-size-fits-all approach when it comes to the frequency of DKIM key rotation, it’s generally recommended to shuffle them **at least every six months** to one year.

Organizations with **higher security requirements** or a [lower tolerance for risk](https://www.proserveit.com/blog/define-risk-tolerance-level) may opt to rotate their DKIM keys more frequently, such as every three to six months. _Those with lower risk profiles may find an annual rotation sufficient._

[![DMARC](https://media.mailhop.org/duocircle/images/2024/05/sender-policy-framework-9246.jpg)](https://media.mailhop.org/duocircle/images/2024/05/sender-policy-framework-9246.jpg)

### Additional Authentication

Deploying [DMARC](/email/dmarc) helps **mitigate the overall impact** of replay attacks by instructing recipients’ mail servers how to handle emails that fail authentication checks. 

_DMARC also requires that the domain’s ‘From’ address aligns with the domains used in [SPF](/content/spf-record-check) and DKIM, making it **more difficult for attackers** to replay a DKIM-signed email._

### Rate Limiting and Monitoring

By **monitoring outgoing email patterns**, organizations can identify unusual activity that may signify a replay attack, such as a sudden spike in email volume or abnormal sending patterns. Implementing [rate limiting](https://www.vaadata.com/blog/what-is-rate-limiting-how-it-works-and-implementation-techniques/) helps **control the number of emails sent** within a specific time frame, reducing the impact of any unauthorized email transmissions. 

Together, these strategies ensure that any anomalies are **promptly flagged and addressed**, enhancing the overall [email security](/) and integrity of the system.

## Topics

email securityNewsUpdates 

![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) 

Brad Slavin 

General Manager

General Manager at DuoCircle. Product strategy and commercial lead across the email security portfolio.

## Secure your email infrastructure

Protect, authenticate, and deliver. Contact our team to find the right solution.

[Contact Sales](/contact/) [Explore Products](/products/) 

Share this article

[ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Femail-security%2Fdkim-replay-attack-a-new-cyberthreat%2F) [ ](https://twitter.com/intent/tweet?text=DKIM%20Replay%20Attack-%20A%20New%20Cyberthreat&url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Femail-security%2Fdkim-replay-attack-a-new-cyberthreat%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Femail-security%2Fdkim-replay-attack-a-new-cyberthreat%2F) Copy 

Related Articles

- [ ![Spam Filters](https://media.mailhop.org/duocircle/images/2023/02/spf-record-tester-9932.jpg)  10 Crucial Tips that Will Help You Avoid Spam Filters and Send Better Emails Email Security ](/blog/email-security/10-crucial-tips-that-will-help-you-avoid-spam-filters-and-send-better-emails/)
- [ ![Email Security](https://media.mailhop.org/duocircle/images/2023/07/dkim-selector-7444.jpg)  Comparing Different AI Approaches to Email Security Email Security ](/blog/email-security/comparing-different-ai-approaches-to-email-security/)
- [ ![Data Privacy And Protection](https://media.mailhop.org/duocircle/images/2022/07/spf-permerror-7082.jpg)  Data Privacy And Protection: 11 Ways To Protect User Data Email Security ](/blog/email-security/data-privacy-and-protection-11-ways-to-protect-user-data/)
- [ ![Emerging Email Security Threats](https://media.mailhop.org/duocircle/images/2023/03/spf-validator-7394.jpg)  Emerging Email Security Threats in 2023 Email Security ](/blog/email-security/emerging-email-security-threats-in-2023/)

## Related Articles

[  Email Security 7m  10 Crucial Tips that Will Help You Avoid Spam Filters and Send Better Emails  Feb 14, 2023 ](/blog/email-security/10-crucial-tips-that-will-help-you-avoid-spam-filters-and-send-better-emails/)[  Email Security 4m  Comparing Different AI Approaches to Email Security  Jul 27, 2023 ](/blog/email-security/comparing-different-ai-approaches-to-email-security/)[  Email Security 18m  Data Privacy And Protection: 11 Ways To Protect User Data  Jul 28, 2022 ](/blog/email-security/data-privacy-and-protection-11-ways-to-protect-user-data/)[  Email Security 7m  Emerging Email Security Threats in 2023  Mar 9, 2023 ](/blog/email-security/emerging-email-security-threats-in-2023/)

```json
{"@context":"https://schema.org","@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}],"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://www.g2.com/products/phish-protection-by-duocircle/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://support.duocircle.com"},"knowsAbout":["Email Security","Email Authentication","SPF","DKIM","DMARC","Phishing Protection","Spam Filtering","SMTP Relay","Email Deliverability","Email Forwarding"]}
```

```json
{"@context":"https://schema.org","@type":"WebSite","name":"DuoCircle LLC","url":"https://www.duocircle.com","description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}
```

```json
[{"@context":"https://schema.org","@type":"BlogPosting","headline":"DKIM Replay Attack- A New Cyberthreat","description":"DKIM Replay Attack- A New Cyberthreat.","url":"https://www.duocircle.com/blog/email-security/dkim-replay-attack-a-new-cyberthreat/","datePublished":"2024-05-17T15:31:43.000Z","dateModified":"2025-05-24T16:58:07.000Z","dateCreated":"2024-05-17T15:31:43.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/email-security/dkim-replay-attack-a-new-cyberthreat/"},"articleSection":"email-security","keywords":"email security, News, Updates","wordCount":724,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2024/05/spf-record-check-7315.jpg","caption":"Cyberthreat","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":2,"name":"Email Security"},{"@type":"ListItem","position":3,"name":"DKIM Replay Attack- A New Cyberthreat","item":"https://www.duocircle.com/blog/email-security/dkim-replay-attack-a-new-cyberthreat/"}]}]
```

```json
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://www.duocircle.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":3,"name":"Email Security","item":"https://www.duocircle.comundefined"},{"@type":"ListItem","position":4,"name":"DKIM Replay Attack- A New Cyberthreat","item":"https://www.duocircle.com/blog/email-security/dkim-replay-attack-a-new-cyberthreat/"}]}
```

```json
{"@context":"https://schema.org","@type":"BlogPosting","headline":"DKIM Replay Attack- A New Cyberthreat","description":"DKIM Replay Attack- A New Cyberthreat.","url":"https://www.duocircle.com/blog/email-security/dkim-replay-attack-a-new-cyberthreat/","datePublished":"2024-05-17T15:31:43.000Z","dateModified":"2025-05-24T16:58:07.000Z","dateCreated":"2024-05-17T15:31:43.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/email-security/dkim-replay-attack-a-new-cyberthreat/"},"articleSection":"email-security","keywords":"email security, News, Updates","wordCount":724,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2024/05/spf-record-check-7315.jpg","caption":"Cyberthreat","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}}
```