What Is DKIM Replay and How to Avoid It

Introduction

DKIM replay is an abuse technique where a message that was legitimately signed with DKIM is copied and resent, often at scale, through another sending path. Because the original message was signed by the real domain, the DKIM signature may still validate when the replayed message reaches recipients.

This can create reputation risk for the signing domain. The message may technically pass DKIM, but it may be delivered in a context the domain owner did not intend. DKIM replay is different from a normal DKIM failure: the problem is not that the signature is broken, but that a valid signature is being reused.

Quick answer

DKIM replay

DKIM replay means a valid DKIM-signed email is reused outside its intended sending context.

1. Your domain sends a real DKIM-signed email.
2. Someone receives or captures that message.
3. The message is resent many times through another system.
4. The DKIM signature still passes if signed parts of the message remain unchanged.
5. Recipients may associate the replayed traffic with your domain.

Why DKIM can pass

DKIM signs selected headers and body content. If those signed parts are not changed, the signature can remain valid even when the message is resent.

• Signed headers remain unchanged
• Body content is not modified beyond the allowed canonicalization
• The DKIM public key still exists in DNS
• The signature has not expired if an expiration tag is used
• The receiving server can verify the signature

Replay vs spoofing

Why replay matters

DKIM replay matters because it can damage trust in a legitimate domain. If a signed message is replayed at scale, receiving providers may see unusual volume, complaints or spam signals connected to the signing domain.

• Domain reputation damage
• Spam-folder placement
• Abuse complaints
• DMARC report anomalies
• Provider throttling
• Brand trust issues
• Deliverability problems for legitimate mail

Common scenarios

Why this matters

This is why DKIM should be used together with SPF, DMARC, reputation monitoring and strict control over sending sources.

How to detect replay

DKIM replay is usually detected through patterns, not a single DNS lookup.

1. DMARC aggregate reports — look for unusual sources passing DKIM for your domain.
2. Sending IPs — identify IPs that are not your normal providers.
3. DKIM selector usage — check which selector is signing suspicious traffic.
4. Volume anomalies — look for sudden spikes from unexpected sources.
5. Complaint patterns — watch spam complaints tied to specific campaigns or signatures.
6. Message samples — compare suspicious copies with legitimate signed messages.
7. Third-party senders — review which platforms are allowed to sign mail for your domain.
8. Reputation signals — monitor blacklist, spam placement and domain reputation.

Common problems

How to reduce risk

1. Step 1: Enable DMARC reporting

   Use aggregate reports to see which sources pass SPF and DKIM for your domain.

2. Step 2: Inventory legitimate senders

   List every platform allowed to send and sign mail for the domain.

3. Step 3: Review DKIM selectors

   Remove old selectors and rotate keys when needed.

4. Step 4: Limit third-party signing

   Only allow trusted systems to sign with your domain.

5. Step 5: Use DMARC alignment

   Make sure DKIM aligns with the visible From domain where appropriate.

6. Step 6: Use signature expiration if supported

   Shorter signature validity can reduce the useful lifetime of replayed messages.

7. Step 7: Monitor unusual volume

   Look for spikes from unknown IPs, selectors or providers.

8. Step 8: Separate mail streams

   Use different selectors or subdomains for transactional, marketing and third-party mail.

9. Step 9: Investigate suspicious samples

   Compare headers and content to identify whether messages were replayed.

Suspicious pattern:
DKIM: pass
From: example.com
Source IP: not a known sender
Volume: sudden spike
Message body: identical to old campaign
Selector: marketing2026

Checks:
DMARC reports show unknown IP.
SPF does not align.
DKIM aligns and passes.
Complaints increased.
Old selector still active.

Possible action:
Pause related campaign.
Remove stale selector if unused.
Review third-party sender access.
Rotate DKIM key.
Monitor DMARC reports.

DKIM and DMARC

DMARC helps because it requires alignment between the authenticated domain and the visible From domain. It also gives domain owners reports about who is sending mail using their domain.

• Unknown DKIM-passing sources
• Unusual IP addresses
• Selector abuse
• Failing SPF with passing DKIM
• Forwarding or redistribution patterns
• Third-party platforms sending unexpectedly

Selector strategy

Selectors help separate different DKIM keys and sending systems.

• Use separate selectors for major providers
• Remove unused selectors
• Rotate keys periodically
• Avoid sharing one selector across unrelated systems
• Document selector ownership
• Monitor selector usage in DMARC reports
• Use subdomains for separate mail streams where needed

What replay is not

DKIM replay is not the same as every DKIM problem.

• A missing DKIM record
• A broken selector
• A malformed public key
• A normal forwarding issue only
• SPF failure by itself
• DMARC policy missing by itself
• Proof that the domain owner intentionally sent the replayed mail

Frequently asked questions