Why am I receiving Temu spam emails with valid DKIM signatures from Disney or Homegoods domains?

Marketer from Email Geeks, Brian Sisolak, asked if someone let Acoustic know about the DKIM keys still coming with spop1024. Expert from Email Geeks, Al Iverson, then shares headers with Brian and Brian lets Acoustic know, and they are on it.

Email marketer from Reddit comments that affiliate programs can be difficult to control, and some affiliates may use aggressive tactics that border on spam. While the DKIM is valid, the sending practices are questionable.

Email marketer from EmailOnAcid explains that sometimes, legitimate brands use third-party email marketing services or affiliate programs which can be exploited by spammers. If the third-party service has valid DKIM for the brand, spam can appear legitimate.

Marketer from Email Geeks, Tim Starr, points out the Friendly From of "Temu Pallets" looks unauthorized and questions why Disney or Homegoods would de-brand their email like that.

Email marketer from an Email Marketing Forum explained that they had once had this issue themselves and it was from really old mailing lists from a previous company. This lists had sat idle for 10 years, but Temu or their affiliates bought the list.

Email marketer from LinkedIn highlights that the brand's domain reputation might be suffering due to affiliate marketing practices. Even with valid DKIM, aggressive or misleading affiliate tactics can lead to the domain being flagged as spam.

Marketer from Email Geeks, Alison Gootee, states that they cannot comment as they are in an active investigation of this sending behavior.

Email marketer from Quora suggests that a possible reason is that a list that you are on has been sold to a company, and then sold to Temu affiliates who have then begun sending the emails.

Email marketer from StackExchange suggests that one possibility is that an account within Disney or Homegoods' marketing system has been compromised, and the spammer is using it to send emails with a valid DKIM signature.

Email marketer from Reddit explains that sometimes companies will work with bad affiliates that send email without following the rules, and as long as they are using DKIM from the company you can't block them.

Email marketer from EmailDrips Blog explains that a potential reason could be that even with legitimate DKIM signatures, email service providers (ESPs) may filter emails as spam based on other factors like content, sender reputation, and recipient engagement.

Email marketer from Reddit explains that it's likely an affiliate pushing Temu offers through various means, some legitimate, some less so. The valid DKIM means someone with authorized sending privileges is sending it.

Email marketer from EmailSecurityPro Blog addresses the issue of brand impersonation, where spammers successfully mimic legitimate brands and compromise the brand's reputation by piggybacking on the positive relationships the brand has fostered with customers.

Expert from Word to the Wise, Laura Atkins, emphasizes that while DKIM and other authentication methods verify the sender, they don't guarantee the email is wanted or legitimate. A compromised account or a rogue affiliate can still send spam with valid authentication.

Expert from Email Geeks shares that he received a similar Temu spam email with a dkim=pass header.i=@em.homegoods.com header.s=spop1024.

Expert from SpamResource explains that the issue is likely due to abuse within an affiliate marketing program. Legitimate companies like Disney or HomeGoods may have affiliate programs, and unscrupulous affiliates might engage in spammy tactics, still using the company's DKIM.

Expert from Email Geeks, Al Iverson, suggests the issue is a hacked account. Marketer from Email Geeks, Tim Starr, adds that Temu has gone into the affiliate offer business and suspects an ATO (Account Takeover). Al also states he assumes the bad guy is an affiliate.

Documentation from RFC Editor explains that DKIM is designed to verify the message has not been altered during transit, and that it was indeed sent by the entity which owns the signing domain. It says nothing about the content or intent of the message.

Documentation from Microsoft states that spammers can abuse SPF records to pass DKIM by gaining access to the domains email servers or by impersonating the domain owner.

Documentation from SparkPost explains that a valid DKIM signature confirms the email was sent by a server authorized to send on behalf of the domain, but it does not guarantee the content is legitimate or desired by the recipient. It only confirms the sender's identity.

Documentation from Google explains that spammers sometimes spoof legitimate domains by using authorized services to send emails. If a domain is configured correctly it's emails will pass authentication checks even if they are used to send spam.