What are the symptoms of a DKIM replay attack and how can a compromised account be identified?

Email marketer from Reddit shares that an indicator of DKIM Replay Attacks is typically an increase in failed SPF checks in combination with DKIM failures from the same sending IP. This is due to the attacker replaying the message from a server they control which is not authorized to send on your behalf.

Email marketer from Email Marketing Forum explains that a sudden spike in bounce rates, especially hard bounces, can indicate that your domain is being used to send spam via a DKIM replay attack. Monitor bounce rates alongside DMARC reports.

Email marketer from Reddit mentions to look for new or changed forwarding rules, especially those forwarding to external addresses, as this is a common sign of a compromised account being used for spam or phishing.

Email marketer from Digital Ocean notes that DKIM replay attacks often involve the attacker resending legitimate emails from your domain, but with malicious content added. This can lead to reputational damage and blacklisting. Regularly audit your DKIM records.

Email marketer from Word to the Wise shares that DKIM replay attacks often show a sudden spike in email volume, especially from unfamiliar IPs. DMARC failure reports will also increase, indicating authentication issues. He recommends monitoring email volume and DMARC reports closely.

Email marketer from Mailhardener explains that a compromised account might exhibit signs like password changes the user didn't initiate, unusual login locations, and unauthorized access to connected apps. They advise setting up multi-factor authentication (MFA) and regularly auditing account activity.

Email marketer from SparkPost notes that detecting compromised accounts involves monitoring login activity for unusual patterns. This includes logins from unfamiliar locations, multiple failed login attempts, and changes to profile information or password. Implement alerting systems to notify users of suspicious activity.

Email marketer from Reddit suggests monitoring login locations for unusual activity such as logins from countries where the user has never been, as this can indicate a compromised account. Implement geo-filtering to restrict access from certain regions.

Expert from Email Geeks explains that the described situation doesn't sound like a DKIM replay attack. Typically, a DKIM replay attack would show a huge increase in volume for that DKIM domain in Google Postmaster Tools, like 5 or even 10x normal.

Expert from Email Geeks asks if the customer's mail that is seeing an increase in DMARC reports is being double signed.

Expert from Word to the Wise explains that DKIM replay attacks are difficult to detect because the attacker replays a validly signed email. They suggest paying attention to changes in sending patterns, such as a sudden increase in email volume or emails being sent to recipients who don't normally receive emails from you.

Expert from Email Geeks suggests the possibility that the client's account was compromised.

Documentation from RFC Editor (RFC 6376) explains that although the standard does not directly prevent replay attacks it highlights the need for implementations to consider the possibility of replay and to implement appropriate countermeasures to mitigate risks where necessary. This can be achieved through short signature validity and time stamping.

Documentation from Microsoft recommends checking audit logs for unusual activity such as password changes, email forwarding rules being added, or unusual sign-in locations. Also, look for unusual email sending patterns or file access activity.

Documentation from Google Workspace Admin Help explains that suspicious activity in a user account can include unusual email sending patterns, such as sending a large number of emails or sending emails to recipients the user doesn't normally contact. Also look for changes to account settings, like forwarding rules or recovery email addresses.