I've been reading about DKIM and one of the reasons it cannot be "hacked" is because an attacker doesn't have access to a server's DKIM private key.
But what if the attacker has access to the domain's DNS records? What stops them from generating their own separate public/private key pair, and then starts sending?
Is the threat level of doing this the same as obtaining the private DKIM keys?