DKIM Replay Attacks

In a DKIM replay attack, an attacker intercepts a legitimate DKIM-signed email message and then resends it to the intended recipient or a different target multiple times without making any changes to the message content or signature. The goal of this attack is to exploit the trust established by the DKIM signature, causing the recipient to believe they are receiving multiple copies of the same legitimate message.

How do DKIM Replay Attacks Work?

In a DKIM replay attack, malicious individuals can use the leniency of DKIM signatures to deceive email recipients and potentially spread harmful content or scams. 

Let’s break down how a DKIM replay attack works, step by step:

DKIM Signature Flexibility

DKIM allows the signature domain (the domain that signs the email) to be different from the domain mentioned in the “From” header of the email. This means that even though an email claims to be from a particular domain in the “From” header, the DKIM signature can be associated with a different domain.

DKIM Verification

When an email recipient’s server receives an email with a DKIM signature, it checks the signature to ensure that the email hasn’t been altered since it was signed by the domain’s mail servers. If the DKIM signature is valid, it confirms that the email went through the signing domain’s mail servers and hasn’t been tampered with during transit.

Exploiting Highly Reputed Domains

Now, here’s where the attack comes into play. If an attacker manages to take over or hack into a mailbox, or create a mailbox with a domain that is highly reputed (meaning it’s a trusted source in the eyes of email servers),they leverage the domain’s reputation to their advantage.

Sending the Initial Email

The attacker sends a single email from their high-reputation domain to another mailbox they control. This initial email could be harmless or even legitimate to avoid suspicion.

Re-Broadcasting

Now, the attacker can use the recorded email to re-broadcast the same message to a different set of recipients, often those who were not originally intended by the legitimate sender. Since the email has its DKIM signature intact from the high-reputation domain, email servers are more likely to trust it, thinking it’s a legitimate message – thereby bypassing authentication filters. 

Steps to Prevent DKIM Replay Attacks

DKIM replay attack prevention strategies for email senders: 

1. Oversigning Headers

To ensure that key headers like Date, Subject, From, To, and CC cannot be added or modified after signing, consider over-signing them. This safeguard prevents malicious actors from tampering with these critical message components.

2. Setting Short Expiration Times (x=)

Implement as brief an expiration time (x=) as practically possible. This reduces the window of opportunity for replay attacks. Newly created domains must have an even shorter expiration time than older ones as they are more vulnerable to attacks. 

3. Employing Timestamps (t=) and Nonces

To further prevent replay attacks, include timestamps and nonces (random numbers) in the email headers or body. This makes it difficult for attackers to resend the same email at a later time because the values would have changed.

4. Rotating DKIM keys Periodically

Rotate DKIM keys regularly and update your DNS records accordingly. This minimizes the exposure of long-lived keys that could be compromised and used in replay attacks.

DKIM replay attack prevention strategies for email receivers: 

1. Implementing Rate Limiting

Receivers may implement rate limiting on incoming email messages to prevent attackers from flooding your system with replayed emails. To do so you can set limits on the number of emails accepted from a specific sender within a given timeframe.

2. Educate Email Recipients

Educate your email recipients about the importance of DKIM and encourage them to verify DKIM signatures on incoming emails. This can help reduce the impact of any potential replay attacks on your recipients.

3. Network Security Measures

Implement network security measures to detect and block traffic from known malicious IP addresses and sources that might be involved in replay attacks.