How to Respond to a DKIM Replay Attack in Microsoft 365
Question details
The organization needs to stop a DKIM replay attack where threat actors are forwarding messages through Microsoft 365 servers to abuse the organization's identity.
- Product
- Microsoft 365 Exchange Online
- Device & OS
- not provided
- Scenario
- Attackers are bypassing standard spam filters by routing emails with valid DKIM signatures through third-party servers, spoofing the organization's domain.
- Observed behavior
- Spoofed messages are successfully passing DKIM checks because the original signature remains valid during forwarding, leading to domain abuse and potential reputation damage.
Before reaching out to support, gather the complete email headers and message traces of the spoofed emails, as security teams require this evidence to identify the originating servers.
Report the Abuse to the Microsoft Security Response Center (MSRC)
This is the most direct method to notify Microsoft's security team about attackers abusing their infrastructure for DKIM replay attacks.
The Microsoft Security Response Center investigates vulnerabilities and abuse originating from or affecting Microsoft services. Providing them with detailed logs helps them block the offending tenants.
Open your web browser and navigate to the official MSRC reporting page at https://msrc.microsoft.com/create-report.
Select the option to report abuse or a security vulnerability. Fill out the required forms, clearly stating that Microsoft 365 servers are being used to facilitate a DKIM replay attack against your domain.
Alternatively, you can email secure@microsoft.com directly. Attach the raw email headers (.eml or .msg files) of the replayed messages to help the team trace the origin.
Open a Microsoft 365 Support Ticket
If you are a Microsoft 365 customer with a custom domain, use the admin center to escalate the routing issue.
Review and Enforce Strict DMARC Policies
While DMARC alone may not entirely prevent replay attacks, ensuring your policy is set to strict rejection minimizes the impact of improperly formatted spoofing.
Looking for a Secure and Free Alternative to Microsoft Office?
While dealing with complex domain security and email abuse issues, you can simplify your document management and reduce enterprise software costs. WPS Office is a lightweight, secure, and highly compatible alternative to Microsoft Office, offering essential tools for creating and editing documents without the hefty price tag.
- 1. Download the software: Visit the official WPS Office website and download the free installation package for your operating system.
- 2. Install WPS Office: Run the installer and follow the on-screen prompts to set up the suite on your computer.
- 3. Open your files: Launch WPS Office and directly open your existing .docx, .xlsx, or .pptx files to continue working seamlessly.
Frequently Asked Questions
What is a DKIM replay attack?
A DKIM replay attack occurs when a threat actor takes a legitimate email that was already authenticated and signed with a valid DKIM signature, and re-sends (or replays) it to new recipients. Because the email retains its original cryptographic signature, it bypasses standard spam filters.
Why doesn't SPF stop a DKIM replay attack?
SPF (Sender Policy Framework) only verifies the IP address of the immediate sender. When an email is forwarded through a reputable server (like Microsoft 365), the receiving server may trust the forwarder's IP, and the valid DKIM signature allows the message to pass DMARC checks, rendering SPF ineffective in this specific scenario.
How can I rotate my DKIM keys in Microsoft 365?
To rotate DKIM keys, log into the Microsoft 365 Defender portal, navigate to Policies & Rules > Threat policies > Email authentication settings > DKIM. Select your domain and click 'Rotate DKIM keys'. This invalidates older signatures that attackers might be trying to replay.
Does Microsoft charge a fee to investigate security reports sent to MSRC?
No, the Microsoft Security Response Center investigates suspected security vulnerabilities and abuse reports free of charge to maintain the integrity and safety of their infrastructure.
