Detecting forged emails that pass DKIM via a stolen subdomain key

Email authentication has long given organisations a false sense of safety. A message showing a green DKIM signature looks legitimate, the cryptographic seal seems to vouch for the sender, and most gateways let it through without a second thought. Yet attackers have learned that if they can quietly obtain the private signing key used by a subdomain, every check tied to that key becomes meaningless.

For Australian teams, this matters more than ever. The Australian Cyber Security Centre regularly warns that adversaries are shifting from obvious phishing to subtler techniques, including the hijacking of legitimate signing infrastructure. Scamwatch data from the ACCC likewise shows losses from business email compromise climbing year after year. A clean DKIM pass is no longer enough to declare a message trustworthy.

Why DKIM alone can be misleading

DKIM was designed to prove that a message left the mail server holding the matching private key and that its contents were not altered in transit. The protocol was never meant to prove that the entity using that key had the right to send on behalf of the brand in the visible From header. When a subdomain's private key is stolen through a misconfigured DNS provider, a leaked CI/CD pipeline, or an exposed provisioning script, the attacker can sign mail that the world believes is authentic.

The signing domain will still match a record you control. The selector will resolve correctly. The signature will verify. What DKIM cannot tell you is whether the person holding the key is still the person you hired last quarter or a criminal sitting in a different time zone.

Telltale header patterns in subdomain abuse

A forged message that passes DKIM via a compromised subdomain's private key often leaves subtle fingerprints in the headers. Start by comparing the d= tag with the visible From address. A payroll notice claiming to come from payroll.yourcompany.com.au but signed by mail.partner-logistics.com is a strong red flag, even when both pass cryptographic validation.

Selectors deserve attention too. Long-running brands usually rotate selectors on a predictable schedule. A sudden switch from a familiar s= value to one that was registered days before a campaign begins points to fresh, attacker-controlled signing. Likewise, a sudden spike in mail signed from subdomains that have never sent legitimate traffic, such as bounce-handler, notifications-update, or similar auto-generated labels, should be treated as suspect.

Comparing the signing domain against observed behaviour

Headers tell only half the story. The signing domain must be cross-referenced with the message's observable behaviour, including the envelope sender, the Reply-To address, and any links embedded in the body. A genuine message from a Sydney-based finance team will not redirect replies to a Gmail address created last week. It will not include a link to a freshly registered .com domain when the brand is known to operate a .com.au presence.

Australian scams frequently impersonate the ATO, myGov, Australia Post, and the major banks. When a message arrives looking like an ATO overdue notice but the signing domain is a small marketing subdomain of an unrelated Adelaide retailer, the misalignment becomes obvious to anyone who looks. Most defenders never look.

Where DMARC alignment changes the picture

DMARC adds the layer DKIM lacks. It ties the cryptographic signature to the domain a human reader actually sees in the From field. Once a strict policy of quarantine or reject is published, mail that passes DKIM through a stolen subdomain key but fails alignment starts to bounce. Reviewing a practical DMARC guide helps teams see exactly how relaxed versus strict modes behave when subdomains are involved, and why alignment, not signature validity, is the true test of authenticity.

Larger operations should also verify the infrastructure behind their bulk mail streams. Security leads in Brisbane and Perth in particular should require partners to publish valid DMARC records and disclose signing infrastructure, since attackers often target the weakest subdomain rather than the apex domain itself.

Forensic clues hidden in message bodies and metadata

When a suspicious message slips past the gateway, forensic work begins. Inspect the Received chain for hop counts and clock skew. A message claiming to come from a Melbourne office but routed through Eastern European relays with reverse DNS pointing at bulletproof hosting is a contradiction worth noting. Look at embedded images, tracking pixels, and link shorteners. Newly registered domains, especially those using privacy services or exotic registries, are common companions to subdomain-key abuse.

Language and formatting also give clues. Many attacks targeting Australian recipients use slightly off currency formats, the wrong date style, or unfamiliar salutations. A spoofed invoice that prices services in USD when the supplier is contracted in AUD has crossed from forgery into carelessness, which is exactly when defenders should escalate.

Building a workflow that flags these attacks early

Detection should not start and end with a single signature check. A mature workflow combines automated reputation scoring, continuous DKIM key monitoring, and alerting when subdomains begin sending mail that was previously dormant. Tools such as Trusted Sender Score allow teams to run bulk domain lookups across a portfolio, surface unexpected signing changes, and integrate the results into ticketing or SOAR platforms via API.

Pair those technical controls with human habits that suit local conditions. Encourage staff in Melbourne and Sydney offices to confirm high-value transfers through a known phone number, not by replying to the message itself. Treat any signed email that asks for a change of bank details, no matter how clean the headers look, as a candidate for verification.

It is also worth running a periodic review of sender trustworthiness across the entire bulk-sending fleet, since a stolen subdomain key often originates from a third-party ESP rather than the brand itself. DKIM passing does not mean the message is safe; only context, alignment, and a healthy scepticism can do that.