I have been playing around with sending emails via telnet using text commands.


Say I send an email from a typical mail agent that adds a dkim signature from [email protected] to [email protected].

If I grab the message source (just including the headers listed in the DKIM-Signature header and the body) from [email protected] and send it as the "data" of a telnet session email from [email protected] to [email protected], should the dkim pass? Or is there some mechanism that stops an email in dkim that stops an email from being sent twice with the same exact headers & body?

  • The DKIM spec requires signing the Date header, and while it allows for some variability, your attack would have to happen within a second or two of the original message that it replays.
    – Adam Katz
    Commented Sep 24, 2019 at 16:03

1 Answer 1


In DKIM the senders MTA signs the message and some headers using a private key only known to this MTA. The signature was explicitly designed to survive redistribution of the unmodified mail. This kind of redistribution is what you are doing with telnet.

In other words: the DKIM signature is specific to the mail itself and not specific to the process of sending the mail. This is different from SPF which cares about the actual process of delivery only by checking the senders IP address against the claimed sender in the SMTP envelope but does not care about the actual content of the mail.

  • Thanks for the clear response. So it should work... unfortunately they way I'm testing is by sending to a gmail address and google drops the email (it responds with "OK" when I end the transmission, but never delivers the email -not even to spam-, even though other emails I've sent via the telnet process were delivered.) Commented Sep 20, 2019 at 22:16
  • @DedicatedManagers: It is not clear what you are really doing (not enough details to reproduce). But having a valid DKIM signature does not mean that the mail will magically pass any spam checks. Anyway, your question was answered and what you describe now is a different problem and thus should be asked as a new question with sufficient details. Commented Sep 21, 2019 at 5:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .