DKIM oversigning
Listing a header field in DKIM's h= tag more times than it appears, so that adding another copy of that field after signing breaks the signature.
What it means
A verifier checks only the header instances the signature lists, counted from the bottom up. An attacker holding a validly signed message can therefore add a second From or Subject above the signed one; some mail programs display the unsigned copy while DKIM still passes. RFC 6376 describes this attack on extra header fields.
The defence is to name each important field one more time than it occurs, for example h=from:from:subject:subject. The extra entry signs the absence of a further instance, so any added copy invalidates the signature.
RFC 6376 notes that one extra entry per field is enough to block any further additions.
Example
h=from:from:to:to:subject:subject:date:date:message-id:message-idRelated terms
Sources
What this definition rests on. The wording is ours; the facts are theirs.
All 432 terms in the glossaryThe wiki: blocklists and bounce codes