DKIM (DomainKeys Identified Mail)<\/a> works by applying a digital signature to specific headers and the body of the email when it is first sent. This signature is generated using the sender\u2019s private key and is attached as a header in the email itself.<\/p>\n\n\n\nWhen the message is forwarded, the original DKIM signature usually remains untouched<\/strong> as long as the email content and headers covered by the signature are not modified. Since forwarding services often preserve the original message as-is<\/em> (especially in cases like aliasing or server-side forwarding), the DKIM signature remains valid and can still be verified using the sender’s public DNS record.<\/p>\n\n\n\n dkim=pass<\/mark><\/code> <\/p>\n\n\n\nStep 3: Attacker sends the email from Outlook<\/strong><\/h3>\n\n\n\nThe attacker used an Outlook account (x186997@outlook.com<\/mark>) to send the spoofed message.<\/p>\n\n\n\nOutbound hop:<\/p>\n\n\n\n
Server:<\/em> LO3P265CU004.outbound.protection.outlook.com<\/mark>
IP:<\/em> 40.93.67.3<\/mark><\/p>\n\n\n\nIn another example<\/strong>, the origin of the email is Google’s notification service<\/strong>. The email flow is described in the attack reproduction section at the end of this article.<\/p>\n\n\n\nStep 4: Message is relayed through Jellyfish SMTP<\/strong><\/h3>\n\n\n\nMicrosoft then hands the message over to a custom SMTP service:<\/p>\n\n\n\n
Relay:<\/em> asp-relay-pe.jellyfish.systems<\/mark>
IP:<\/em> 162.255.118.7<\/mark><\/p>\n\n\n\nThis system acts as a middle relay<\/strong>, distancing the spoof even further from Google. It\u2019s not affiliated with Namecheap or PrivateEmail.<\/p>\n\n\n\n
![\"\"](\"https:\/\/easydmarc.com\/blog\/wp-content\/uploads\/2025\/04\/1744359709180-767x1024.png\")
<\/figure>\n\n\n\n