An attacker obtains one signed message from a reputable sender (for example by sending spam through a free account or a compromised mailbox that the provider signs) and replays it from their own infrastructure. The signature remains valid for anyone who receives a copy, and the recipient addresses live only in the envelope, which DKIM does not sign.
Mitigations exist on both sides: signers can oversign headers such as To, Cc and Subject, set short expiry with x=, refuse to sign mail that looks like spam and rotate selectors after abuse; receivers can rate-limit identical signatures seen at volume. The IETF DKIM working group documented the problem in a replay problem statement and designs DKIM2 to bind the envelope and sign each hop.