DKIM replay
An abuse in which someone obtains one message validly signed by a reputable domain and resends it to many recipients, borrowing that domain's reputation.
What it means
A DKIM signature proves a message was signed by a domain and not altered; it does not bind the message to the recipients or to the time it was sent. A spammer can send one message through an account at a well-known provider, receive it signed, and replay it unchanged to thousands of addresses. Receivers see a valid signature from a trusted domain. RFC 6376 described this in 2011 as the replay/spam attack.
Defences are partial. Signers can limit what a replayed copy can be turned into by oversigning headers and avoiding l=, and can revoke a key used for abuse, though one key often signs for many users. RFC 6376 notes that large receivers can spot unusual volumes of one signature in a short time.
The IETF DKIM working group described the problem in an Internet-Draft in July 2023; it expired in January 2024 without becoming an RFC.
Related terms
Sources
What this definition rests on. The wording is ours; the facts are theirs.
- RFC 6376: DomainKeys Identified Mail (DKIM) Signatures, section 8.6rfc-editor.org
- IETF draft: DKIM replay problem statementdatatracker.ietf.org
All 432 terms in the glossaryThe wiki: blocklists and bounce codes