4 ms·

> There is still a replay possibility with DKIM even if limited to replaying the exact same message If DKIM signs both the Date: and Message-ID: headers, can y

• joveian 3y ago
  It is if the only thing preventing seeing a resent message as new is the recipient looking at the date or message id. Certainly it is arguable that the client and/or provider tracking seen signatures is a reasonable way to prevent it, but this isn't universally the case at this point and SPF if required (which it never is now unless DKIM isn't used at all) would at least prevent most third parties from doing this (at least without IP spoofing which would be disruptive to do bidirectionally). Not that this is necessarily a sufficient reason to justify using SPF over DKIM only just that it is a consideration. I don't know SMTP enough to know if someone between two servers who can block an encrypted connection at just the right point could cause the sending server to resend a delivered message but I would guess that might be possible. MTA-STS seems infrequently used at this point so currently someone between two servers could likely prevent the use of encryption.