What happens when a DKIM signature expires?

You’ve sent an email. It was signed with DKIM. Now the clock’s ticking. What happens when that signature hits its expiry? Can an attacker reuse it later — to impersonate your domain, deliver spam, or bypass filters?

No. Not unless they’re also able to forge the complete cryptographic chain. DKIM signatures are not permanent. They’re time-bound proofs — tied to a specific message, a specific timestamp, and a short validity window. Think of it like a digital receipt with a short expiry: once it’s expired, it’s no longer valid, even if it’s signed correctly.

Understanding this boundary is critical. If you’re managing sender reputation, email security, or inbox placement, you need to know that expired DKIM signatures cannot be replayed. The receiving server checks the timestamp. If it’s outside the allowed range — minutes to hours after signing — the signature is rejected outright.

Key takeaways

  • DKIM signatures are tied to a specific timestamp and expire within minutes to hours.
  • Expired signatures cannot be reused to authenticate new messages, even by an attacker with access to the original signature.
  • Receiving servers enforce time bounds on DKIM signatures, rejecting them if the timestamp is out of range.

Can attackers reuse or replay expired DKIM signatures?

No. Expired DKIM signatures cannot be reused or replayed to forge emails. A DKIM signature is time-bound by design—once it expires, the receiving server rejects it outright. Attackers can’t repurpose old signatures because each one is cryptographically tied to a specific moment, message content, and domain state. Even if an attacker captures a valid signature, it’s useless after its expiration window.

Time-sensitive authentication prevents replay

DKIM signatures include a timestamp (the i= tag) that servers check against their current time. If a signature is older than the allowed time window—typically within a few minutes to hours—it gets rejected. Servers enforce this strictly; most ignore any signature outside the permitted offset. This makes replay attacks pointless for expired tokens.

Replay attacks only work if an attacker captures a valid, unexpired signature from a real message sent by a legitimate sender. Even then, the signature is only useful once—at the exact time and in the exact context it was generated. Any change to the message body or headers invalidates the signature, and receiving servers detect this immediately.

Each signature is unique to its message state

DKIM signs a cryptographic hash of the message headers and body at the time of sending. That hash is unique—no two messages will produce the same value, even if they’re nearly identical. The signature is generated using a private key from the sending domain’s DNS records. Reusing the same signature later, even with the same content, fails because the hash has already been consumed.

As defined in RFC 6376, DKIM uses time-based validation to ensure signatures cannot be used outside their intended time frame. This is part of the protocol’s core design: signatures are not merely cryptographic proof—they’re temporal proof too. You can’t “age” a signature or replay it at a different time, even if you keep it indefinitely.

For senders, this means you don’t need to be overly concerned about signature exposure. If your domain signs every message correctly—and your private key stays secure—expired signatures pose no practical risk. The system is designed to prevent exactly this kind of abuse. As long as your sending infrastructure follows standards, attackers can’t exploit old DKIM tokens.

Still, it’s wise to verify your sending list regularly. Bad or expired email addresses can undermine your sender reputation, especially if they lead to hard bounces or spam complaints. You can check your list’s health with a bulk verification tool:

Verify your entire email list in seconds to identify invalid, risky, or inactive addresses before sending.

Why the confusion about DKIM replayability exists

Expired DKIM signatures cannot be reused or replayed by attackers because DKIM is designed for one-time message validation, not continuous authentication. Unlike long-lived OAuth tokens or SSO sessions, DKIM signatures include a timestamp and are tied to a specific key’s validity window—once expired, they’re no longer valid, even if the signature is copied.

DKIM isn’t meant to be a session key

It’s common to confuse DKIM with systems like OAuth 2.0 or SSO, where tokens remain valid for hours or days. DKIM wasn’t built for that. Its sole purpose is to verify that an email wasn’t altered in transit and that it comes from an authorized sender at the time it was sent. A signature’s validity is strictly time-bound and context-specific—there’s no persistent session to exploit.

Server-side caching isn’t a security risk

Some systems may cache a signature’s validity briefly to reduce processing overhead. This is a performance optimization, not a flaw. The cached check still validates the signature against the current DNS records and time window, ensuring an expired signature won’t slip through. This behavior is documented in RFC 6376, which defines DKIM’s cryptographic and temporal constraints [RFC 6376].

Even if a malicious actor captures an old DKIM-signed email, trying to replay it later will fail. The signature’s timestamp—part of the DKIM-Signature header—will be outside the key’s validity window, or the public key won’t match the one published in DNS at the time of receipt. This isn't just a theoretical safeguard; it’s baked into the protocol’s design.

Think of DKIM like a signed receipt: it’s only valid for the transaction it covers, at the moment it was issued. Replaying it later—whether months or minutes—doesn’t change the fact that it’s expired. This is why DKIM doesn’t support replay attacks, even in poorly configured environments.

Still, verifying email addresses before sending is key to reducing abuse opportunities. Tools like MailTester’s email checker help detect invalid or risky addresses early, reducing the chance of wasted sends or accidental exposure to abuse vectors—even if a signature would otherwise be valid during delivery.

How DKIM prevents message tampering and impersonation

Expired DKIM signatures cannot be reused or replayed by attackers because DKIM signs the exact content and headers at the time of sending, including a timestamp. Any change — even a single character — invalidates the signature. Even if an attacker copies a valid signature, it only works for that exact message at that exact time. The signature is tied to the original send context, making replay useless.

How DKIM Validates Message Integrity

When you send an email, DKIM generates a digital signature based on the message body, selected headers, and the timestamp. This signature is cryptographically tied to the domain’s private key and verified using the public key published in DNS. If the recipient’s server checks the signature and finds any discrepancy — a changed link, altered sender, or modified subject line — the signature fails.

Let’s say someone tries to intercept your email and add a fake payment link. The signature will no longer match because the content changed. The receiver’s email system knows the message was tampered with, and it’s treated as untrusted. This is how DKIM blocks content manipulation in transit.

The timestamp in DKIM is a key guardrail. It ensures that even if an attacker captures a valid signature, it’s tied to the moment it was sent. That same signature won't work hours or days later — the receiver’s system checks the time, and if it doesn’t match, the signature is rejected outright.

Why Replay Attacks Fail with DKIM

Even if an attacker forges an email with a valid DKIM signature, the signature must match the exact message body, headers, and send time. Without access to your private key, they can't generate a new one. And even if they capture a previous signature, it’s useless after the original time window — not because it’s "expired" in the sense of key expiry, but because it’s time-bound to the original send.

As defined in RFC 6376, the primary purpose of DKIM is to assert the authenticity and integrity of an email at the time of delivery. It doesn’t guarantee the message is clean or not spam, but it does confirm the sender didn’t alter it en route. This makes DKIM a core layer in preventing impersonation and tampering.

For example, if a phishing email has a valid DKIM signature but comes from an unlisted or suspicious IP, the signature still passes. But the signature only confirms origin and content integrity — not trustworthiness. That’s why DKIM works best alongside SPF and DMARC.

To keep your messaging secure, ensure your domain’s DKIM keys are rotated regularly, and validate your list quality before sending. Use tools like MailTester’s email checker to verify addresses in real time, and test inbox placement with inbox testing to validate delivery and reputation signals.

RFC 6376: DomainKeys Identified Mail (DKIM) Signatures

What a domain owner should verify to prevent DKIM misuse

Expired DKIM signatures cannot be reused or replayed by attackers because they are time-bound and validation fails when the signature’s validity window has passed. The real threat isn’t reuse—it’s misconfiguration or long-lived keys that let attackers exploit weak or stale signatures. You must ensure keys are rotated, validity windows are short, and domain use is monitored so unauthenticated messages don’t slip through.

Key actions to prevent DKIM misuse

  • Rotate DKIM keys every 3 to 6 months—longer intervals increase risk if a key is compromised.
  • Set short validity windows (1 hour or less) for signatures using the Expires tag in DKIM to limit exposure if a signature is leaked.
  • Enable and monitor DMARC reports to detect unauthorized use of your domain in email—reports reveal senders not authorized by your policy.
  • Set DMARC policy to reject (not just quarantine or none) to block messages that fail SPF or DKIM, even if one passes.
  • Regularly audit DNS records for unexpected DKIM, SPF, or DMARC entries—automated tools like MxToolbox help detect misconfigs.
  • Use DMARC analytics to track alignment across SPF and DKIM; lack of alignment can be exploited even with valid signatures.

Proactive checks for domain security

Let’s not rely only on email authentication—we should validate the integrity of the entire email stack. Use tools that test your domain’s real-world posture: verify inbox placement for messages sent from your domain to detect delivery failures before they impact users. Also, verify your email list before sending with bulk email verification to ensure only valid, deliverable addresses are used.

As defined in RFC 6376, DKIM signatures are only valid within their time window. Attackers cannot replay expired signatures because validators reject any that fall outside the Expires date. However, if your domain allows long-lived keys or fails to enforce DMARC, attackers can exploit gaps. The strongest defense is combining short validity, regular key rotation, and strict DMARC enforcement.

How email verification tools help prevent misuse of compromised domains

Expired DKIM signatures cannot be reused or replayed by attackers in a way that tricks modern email systems—their time-limited nature is part of the security model. But weak or misconfigured DKIM setups can still allow domain abuse, especially when senders target invalid or compromised addresses. Email verification tools like MailTester stop that risk by filtering out bad addresses before they can be exploited, ensuring only valid, deliverable inboxes receive messages.

Preventing sends to high-risk domains

Many domains with outdated or broken DKIM configurations are vulnerable to forgery or are used in spam campaigns. Sending to these domains increases the chance of bounce, damage to sender reputation, and worse—being flagged as a potential spam source. MailTester’s 98.9% accurate verification detects invalid, catch-all, role-based, and disposable addresses that are common in compromised setups—stopping you from accidentally poisoning your sender reputation.

It doesn’t rely on outdated records. Real-time API checks validate addresses at the moment of verification, not years after they were created. This means you’re not trusting a historical state; you’re confirming what’s active and secure right now. For example, a domain that once had valid DKIM but now doesn’t may still return as “valid” in old data—MailTester’s checks catch that gap immediately.

Seamless integration, stronger defenses

Even the most secure domain won’t help if you’re sending to the wrong inboxes. MailTester integrates directly with platforms like SendGrid, HubSpot, and Mailchimp—ensuring only verified addresses enter your campaigns. You can set up automated verification at the point of capture or before batch sends, so your list stays clean without manual work.

Digital trust starts with address legitimacy. By cleaning your list, you reduce the odds of sending to a domain with a weak or misconfigured DKIM, or one that’s been taken over. This layer of defense isn’t about signing messages—it’s about not sending to targets that could harm your reputation or be used in abuse chains.

Learn how MailTester identifies and removes risky addresses before they ever hit the inbox: verify your entire list.

Why sender reputation matters more than signature age

Expired DKIM signatures can’t be reused or replayed by attackers because they’re time-bound and cryptographically tied to a specific message. The signature’s validity window is enforced by the receiving server, and once expired, it’s rejected. What matters far more is whether your sending behavior appears trustworthy — consistent volume, low complaint rates, and engagement — because spam filters prioritize reputation over signature freshness. A single expired signature won’t get you blocked if you send responsibly.

Reputation isn’t about perfection — it’s about consistency

You don’t need flawlessly timed DKIM signatures to be trusted. What receivers care about is whether your messages are welcome. High open rates, low unsubscribe rates, and few complaints signal that your email is relevant — not spammy. Even if your DKIM signature expires, spam filters won’t flag you unless your broader behavior suggests abuse. A single expired signature on an otherwise well-behaved sender won’t cause issues.

Technical checks don’t capture real-world deliverability

Just because your DKIM signs correctly doesn’t mean your email lands in the inbox. Spam filters evaluate hundreds of signals — including whether the recipient engaged with your last 10 messages. Poor engagement, sudden spikes in volume, or high bounce rates can trigger filtering, even if every technical box is checked. That’s why tools like inbox-placement testing expose what actually happens: your message may pass all technical checks but still end up in spam because of how your audience interacts with your brand.

Let’s be honest — even if your DKIM signature is valid at send time, a pattern of low engagement will hurt you more than a few expired ones. The receiving server sees your history, not just your current signature. If you’re unsure whether your messages are landing where they should, test them in real inboxes before sending. It’s the only way to see if your reputation is working — or if your technical setup is missing the bigger picture.

For a complete view of your sending health, combine technical validation with real-world testing. Bulk list verification catches invalid addresses before they hurt your deliverability. Tools that simulate real inboxes are better than chasing perfect DKIM timing. Focus on what matters: being sent to engaged recipients.

Common misconceptions about DKIM and security

You can’t replay expired DKIM signatures to spoof domains—compliant email servers reject them automatically. DKIM is time-bound by design, and replaying a signature after its expiration window is ineffective. This isn’t an exploit; it’s a security feature. The real risk isn’t expired signatures—it’s misconfigured or unverified sending practices. Let’s clear up what DKIM actually does—and what it doesn’t.

DKIM is not a standalone anti-phishing tool

Digital signatures alone don’t stop spoofing. DKIM verifies that an email was signed by an authorized sender at the domain level, but it doesn’t tell the receiving server what to do with a signed message that isn’t approved. That’s where DMARC comes in. DMARC policies instruct receivers whether to allow, quarantine, or reject emails that fail SPF or DKIM checks—without DMARC, DKIM signatures are verified but ignored.

Think of DKIM as a fingerprint and DMARC as the rulebook. One confirms identity; the other enforces policy. A domain with valid DKIM but no DMARC policy will still allow fraudulent messages to pass if they match the signature criteria.

For this reason, email verification tools like MailTester’s email checker help you validate not just address syntax, but also whether the domain has proper authentication in place—preventing send attempts to domains that are technically valid but insecure.

Why signatures must be unique per message

Each email must have a fresh DKIM signature. Reusing a signature isn't just inefficient—it’s a violation of the protocol. The digital signature includes message-specific elements like timestamps, message body hash, and header fields. These change with every send, so reusing a signature would fail validation.

Forcing a new signature per message is intentional. It prevents attackers from capturing a signature and using it later—this is especially important for time-sensitive messages like password resets. If a signature were reusable, the window for replay attacks would open.

This is why proper email deliverability depends on consistent, correct authentication setup. Tools like MailTester’s inbox placement tester simulate real-world inboxes to verify if a message with valid DKIM and DMARC will actually land in the inbox—and not be dropped or flagged as suspicious.

Authentication Method What It Verifies Enforcement Capability Replay Protection
DKIM Authenticity of the email content and sender domain None—only validates integrity Strong: signatures include time-bound elements and message hashes
SPF Whether the sending IP is authorized by the domain None—only checks sender IP Weak: if IP is authorized, it can be reused
DMARC Policy enforcement for SPF/DKIM failures Strong: enables reject/quarantine based on policy Indirect: policies prevent delivery of unapproved messages

For a deeper look at how email authentication works, refer to RFC 6376, which defines DKIM, and RFC 7489, which details DMARC. These standards confirm that expiration and uniqueness are built into the design, not bugs to exploit.

Best practice: How to secure your DKIM implementation in 2026

Expired DKIM signatures cannot be reused or replayed by attackers—once a signature expires, it’s invalid. But attackers can exploit weak or long-lived keys. The real security comes from using strong algorithms, short expiration windows, regular key rotation, and monitoring DMARC reports. You’re not just protecting your domain; you’re preventing abuse that damages sender reputation.

Secure your DKIM setup with these steps

  1. Use strong cryptographic standards: RSA-SHA256 or ECDSA. Avoid older algorithms like SHA1. These modern standards provide sufficient resistance to cryptographic attacks, even with future advances in computing power. The IETF’s RFC 8301 recommends SHA256 for DKIM specifically to prevent known vulnerabilities in older hash functions.
  2. Set DKIM signatures to expire within 60 minutes. Long-lived signatures increase the window for misuse. Even if a private key is exposed, a short expiration reduces harm. Most email providers validate signatures based on time; a 60-minute limit ensures old signatures are rejected by default.
  3. Rotate your DKIM keys every 90 days. Regular rotation limits exposure if a key is compromised. It’s a proven practice in modern email security. Even with strong encryption, the longer a key is in use, the higher the chance it’s been leaked—perhaps through logs, backups, or misconfigured systems.
  4. Monitor DMARC reports to catch unauthorized use. DMARC reports provide visibility into which domains are sending mail on your behalf. Use tools like dmarc.org or your email provider’s reporting dashboard to detect spoofing attempts or misconfigured third parties.
  5. Use a real-time verification tool like MailTester to clean your list before sending. Even with proper DKIM setup, sending to invalid or risky addresses harms inbox placement and sender reputation. MailTester validates email addresses in real time, flags invalid ones, and detects catch-all or disposable domains. Use their bulk verification tool before every campaign to ensure only valid addresses are sent to.

Why this matters beyond cryptography

DKIM is only one layer. A strong signature means nothing if your sender reputation is damaged by sending to fake or inactive addresses. You can have perfect cryptography and still be blocked if your list is full of dead ends. That’s where real-time email verification comes in. Testing delivery before sending—using a tool like MailTester’s inbox placement tester—reveals where your emails actually land: inbox, spam, or nowhere.

Final thought: DKIM is secure—but not magic

Expired DKIM signatures cannot be reused or replayed because the timestamp in the signature is validated by the receiving server. If the signature is outside the allowed time window—typically a few minutes—it is rejected outright.

Why replay attacks don’t work in practice

  • DKIM includes a timestamp (i.e., ts tag) that is checked during validation.
  • Even if an attacker captures a valid signature, it will be marked as expired and discarded.
  • Replay requires both the signature and a valid timestamp, which changes with each message.

No single protocol offers full protection. DKIM prevents message forgery, but only when paired with SPF, DMARC, and good sender reputation. Without all three, even valid DKIM signatures can fail to pass authentication.

Security is not a single feature. It’s the sum of configuration, monitoring, and prevention.

Tools like MailTester help you act before problems occur. By identifying invalid, catch-all, or disposable addresses before sending, you reduce bounces, improve deliverability, and protect sender reputation.

Sources

Keep reading

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

Can an attacker replay an expired DKIM signature to send a fake email?

No. Expired DKIM signatures are rejected by receiving servers due to timestamp validation. Replay is not possible.

How long is a DKIM signature valid?

Typically 1 hour or less, depending on the domain's configuration. Validity periods are enforced by the receiving server.

Does DKIM prevent all email spoofing?

No. DKIM only verifies message authenticity. DMARC is required to enforce policies and reject unauthenticated sends.

What happens if a DKIM signature is forged or reused?

The receiving server detects the mismatch in content, timestamp, or key and rejects the message.

Can expired DKIM signatures be used for phishing?

No, because expired signatures are rejected during validation. Phishing requires valid, current signatures or other exploits.

It identifies invalid, catch-all, and disposable addresses before sending, reducing exposure to domains with weak or misconfigured DKIM.

What is the role of DMARC in protecting DKIM?

DMARC enforces policy on unauthenticated messages. Even if DKIM passes, DMARC can reject emails if not aligned with SPF or DKIM.

Do email verification tools check DKIM configuration?

No. MailTester verifies address validity, not DNS records. It assumes your domain is configured correctly but flags high-risk addresses.

Is there a risk in using DKIM keys for too long?

Yes. Long-lived keys increase exposure if compromised. Rotation every 3–6 months is recommended.

Can DKIM be bypassed by attackers using a trusted domain?

Only if the attacker gains access to the private key. Proper key management and DMARC enforcement prevent this.

How do greylisting and DKIM interact?

Greylisting delays delivery to unknown senders. DKIM is not affected, but expired signatures on delayed messages are still rejected.

Should I worry about DKIM replay attacks?

No. The protocol prevents reuse through time-bound signatures. Real threats are key compromise or DNS manipulation.