Beyond DKIM key rotation: understanding email replay attacks

Source: AWS Security Blog

Author: Michael Araba

URL: https://aws.amazon.com/blogs/security/beyond-dkim-key-rotation-understanding-email-replay-attacks/

ONE SENTENCE SUMMARY:

DKIM replay abuses durable signatures to authenticate redistributed legitimate emails, requiring message proof, DMARC enforcement, DNS key removal, and monitoring.

MAIN POINTS:

  1. DKIM validates message integrity, so unchanged messages verify anywhere they travel afterward.
  2. Replay attackers resend captured, signed emails from unrelated servers to many unintended recipients.
  3. SPF typically fails during replay, yet DMARC still passes because DKIM aligns.
  4. Enforcing DMARC p=reject stops spoofing, not replay of legitimately signed messages.
  5. Unknown IP with DKIM pass could indicate legitimate relays, replay abuse, or spoofing.
  6. Aggregate DMARC reports reveal anomalies but can’t prove replay without message-level matching.
  7. Effective response starts by inventorying senders, aligning SPF/DKIM, and enforcing DMARC stages.
  8. Key rotation alone doesn’t invalidate previously signed emails while old public keys remain published.
  9. Deleting old DKIM public keys from DNS closes the replay window after in-flight mail clears.
  10. Amazon SES telemetry plus DMARC reports helps detect suspicious DKIM-passing volume gaps faster.

TAKEAWAYS:

  1. Prioritize confirming replay using a sample message and headers, not aggregate statistics alone.
  2. Treat DKIM replay as reputation abuse, since attackers can’t alter content without breaking signatures.
  3. Finish DMARC deployment and sender inventory before making disruptive DNS or SPF hard-fail changes.
  4. Include post-rotation DNS cleanup: remove retired DKIM selectors to invalidate captured-message signatures.
  5. Correlate SES event publishing, DMARC rua reports, and Route 53 selector-query spikes for earlier detection.