How to Detect Phishing Emails With Random Subdomains and Valid DKIM

Most phishing guides warn about misspelled domains, but a quieter trick is spreading across Australian inboxes. Attackers register a real domain, configure DKIM correctly, then send from throwaway subdomains like q.brandname.com or k.brandname.com. The signature passes every automated check, the parent domain looks familiar, and the recipient is more likely to click.

A valid DKIM record only proves the email was signed by a key the domain owner published. It does not prove the owner chose to send this message, or that the subdomain has any relationship with you. Australians who treat DKIM as a green light often hand credentials to scammers pretending to be myGov, the ATO, or the big four banks.

This technique sits in the gap between cryptographic authentication and human trust. Headers look clean, the body feels familiar, and only careful inspection of the sending subdomain reveals the deception.

Recipients in Brisbane, Sydney, and Perth face the same exposure when attackers mimic widely used Australian services. From utilities to health insurers, the urgency cues are consistent.

Why Random Subdomains Trick the Average User

When a message arrives from rX7q.acme-support.com, most readers see the familiar parent domain and ignore what sits before the dot. Attackers exploit this by generating thousands of unique short subdomains, rotating infrastructure daily and dodging simple blocklists.

Because the parent domain often belongs to a legitimate business with a real DKIM key, the email inherits a passing reputation. Major Australian ISPs lean heavily on DKIM results, so the message lands in the inbox. A single-character label reads like a regional prefix, and most people decide whether to trust an email in under ten seconds.

The DKIM Illusion: Why a Passing Signature Is Not a Pass

DKIM confirms a message left a server holding the private key paired with a published DNS record. It does not say who controls that server, whether the sender is authorised to use the brand in the From field, or whether the message is part of a campaign you agreed to receive. DMARC alignment ties the visible From to the DKIM or SPF domain, but misaligned subdomains can still produce a partial pass that some receivers treat as sufficient. Senders worried about legitimate relays should review the forwarded email checklist to see how genuine forwarded traffic shows up.

A DKIM pass on x.brandname.com only proves that whoever owns brandname.com set up the key. Treating DKIM as the final word is the assumption phishers rely on, and it is what makes single-letter subdomain attacks so effective.

Anatomy of a Single-Letter Subdomain Attack

The infrastructure is rented in bulk. Attackers register a parent domain that echoes a trusted brand, point a wildcard record at a server pool, then rotate fresh single-letter subdomains for each campaign. Every wave gets a unique DKIM selector and a clean sending IP.

The visible From header is set to a friendly name like "ATO Online" or "myGov Support", paired with the lookalike subdomain. The body stays short: a link to "verify your details", a deadline, and a clone login page hosted elsewhere. Recipients in Adelaide, Hobart, and on the Gold Coast have reported near-identical templates impersonating utilities, couriers, and healthcare providers.

Red Flags Hidden in the Header and Body

Start by expanding the full From address, not just the display name. A legitimate myGov message comes from my.gov.au, not a hyphenated copy or single-letter prefix. Hover over every link and confirm the destination matches the brand before clicking.

Watch for urgency cues: "final notice", "account suspended within 24 hours", or ATO debt that must be cleared immediately. These match reports lodged through Scamwatch and the ACSC, which publish current scam trends. Also check the Reply-To header. Many campaigns route replies to free webmail, a sign the visible sender domain is cosmetic.

Australian Reporting and Legal Context

Australia's Notifiable Data Breaches scheme, sitting under the Privacy Act 1988, requires organisations to assess and report harms from compromised credentials. If you click through and enter banking or myGov details, both you and the impersonated brand may need to act quickly. The OAIC publishes guidance on eligible breaches.

For individuals, the ACSC's ReportCyber portal is the central place to log an incident, while Scamwatch tracks broader consumer patterns. Reporting helps regulators build a clearer picture of which brands are being mimicked and how infrastructure shifts between Australian and offshore hosts.

Verifying the Sender Without Trusting the Display Name

When an email asks you to act on an account, open a fresh browser tab and navigate to the service directly. For banking, type your bank's known URL or use the official app. The same applies to myGov, the ATO, and any retailer asking for payment updates.

To confirm whether a domain is genuinely associated with a brand, run it through a tool that checks registration age, DNS records, and lookalike similarity. Resources such as lookalike domain detection can surface domains that copy a target brand character by character, including single-letter subdomain hosts. A quick check: has this sender contacted you from this exact address before? A sudden switch from service@brand.com to k.brand-login.com is not a normal migration.

Building a Defence Routine for Inboxes at Home and Work

For individuals, the most effective habit is also the simplest: treat DKIM passes as neutral rather than endorsements. Combine that with two-factor authentication on every account that offers it, particularly email, banking, and government services. An unexpected MFA prompt is one of the cleanest signs that someone else has your password.

For Australian small businesses, the ACSC's Essential Eight framework offers a practical starting point. Disabling inbound mail from unexpected single-letter subdomains catches a surprising share of these campaigns. Pair mail-server rules with periodic DMARC reporting so you can see which subdomains are sending on your brand's behalf, then tighten the policy from p=none to p=quarantine once the data looks clean.