DKIM Replay Attacks Persist Despite Key Rotation; DNS Cleanup is Crucial

The Persistence of DKIM Replay Attacks

Email administrators are observing DMARC reports indicating email passing DKIM verification from unrecognized IP addresses, even after rotating their DKIM keys and setting DMARC to p=reject. This suggests that key rotation alone is insufficient to stop certain types of email attacks.

The issue stems from DKIM replay attacks, where an attacker re-sends an unmodified, legitimately signed email. Since the message content remains unchanged, the original DKIM signature continues to validate, leading to DMARC passing despite the email originating from an unauthorized server.

How DKIM Replay Attacks Function

DKIM's purpose is to verify that specific parts of an email have not been altered between the sender and receiver. A private key signs the message, and the corresponding public key, fetched from DNS, validates the signature. This design means a valid signature persists even if the message is forwarded or relayed.

In a replay attack, an attacker obtains a copy of a legitimate, signed email (e.g., from a mailing list or compromised mailbox). They then re-send this exact message from their own infrastructure to new recipients. The receiving servers validate the unchanged DKIM signature, causing DMARC to pass, even if Sender Policy Framework (SPF) fails due to the unauthorized sending IP.

Mitigation Beyond Key Rotation

Standard DKIM key rotation guidance often overlooks a critical DNS cleanup step necessary to prevent replay attacks. While the article does not specify the exact step, it implies that simply changing the key is not enough; further action related to DNS records is required to invalidate old signatures or prevent their re-use.

Understanding the limitations of what an attacker can do—they cannot modify message content or add new information—is key to defining the problem and implementing effective countermeasures.