Is it as dangerous to modify DKIM domain's public key, as to get a domains' sending private keys?

Question

I've been reading about DKIM and one of the reasons it cannot be "hacked" is because an attacker doesn't have access to a server's DKIM private key.

But what if the attacker has access to the domain's DNS records? What stops them from generating their own separate public/private key pair, and then starts sending?

Is the threat level of doing this the same as obtaining the private DKIM keys?

Answer 1

If an attacker has full control of your DNS records you've got bigger problems than spam email being sent. Yes, they'd be able to send email that looks legitimately from your domain if they can change DKIM/SPF records.

The correct solution is not to let them get control of your DNS.