Email Header Analysis and Authentication DFE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An email with a DKIM signature shows 'dkim=pass' in the Authentication-Results header, but the From header domain is different from the d= domain in the DKIM signature. What does this indicate?

   • AThe email is authenticated for the d= domain, but DMARC alignment may fail if the From domain is not aligned.
   • BThe DKIM result should be 'fail' because the signature does not cover the From header.
   • CThe email is definitely spoofed because the From domain and d= domain differ.
   • DThe DKIM signature is invalid because the From domain must match the d= domain.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   You are investigating a phishing email that bypassed your email gateway. The email has a valid DKIM signature for your company's domain, but the Received headers show that the email entered your network from an IP address that is not in your DKIM signing server's IP range. What is the most likely explanation?

   • AThe email was sent from a server that is authorized in your SPF record, so DKIM is not needed.
   • BThe DKIM signature is invalid because the sending IP is not in the signing server's range.
   • CThe DKIM signature was generated by an attacker who obtained your private key.
   • DThe email was relayed through a legitimate server that re-signed the DKIM signature.
   Reveal Solution Discussion Select an answer first
4. 8expert · medium

   A company's SPF record is: v=spf1 include:spf.example.com -all The company uses a third-party email service that sends from IP 203.0.113.50. The SPF record for spf.example.com includes that IP. However, an email sent by the service is failing SPF. The Authentication-Results header shows spf=fail (sender.com: 203.0.113.50 is not authorized). What is the most likely cause?

   • AThe SPF record for spf.example.com is missing the IP
   • BThe receiving server does not support SPF
   • CThe SPF record is missing the 'include' mechanism
   • DThe email's envelope sender domain is not the company's domain
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   You are tracing an email's origin. The Received headers show the following (top to bottom): Received: from mx2.contoso.com (192.0.2.20) by mx1.contoso.com; Fri, 12 Jan 2024 10:00:01 +0000 Received: from mail.attacker.com (198.51.100.5) by mx2.contoso.com; Fri, 12 Jan 2024 09:59:30 +0000 Received: from [203.0.113.7] (unknown) by mail.attacker.com; Fri, 12 Jan 2024 09:58:45 +0000 What is the originating IP address of the email?

   • A203.0.113.7
   • B198.51.100.5
   • C192.0.2.20
   • Dmx1.contoso.com
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An email administrator is troubleshooting why legitimate emails from the company's marketing platform are being marked as spam. The SPF record for the domain is: v=spf1 include:marketing.example.com -all The marketing platform sends emails from IP 203.0.113.50, which is listed in marketing.example.com's SPF record. However, the receiving server reports SPF fail. Which of the following is the most likely cause?

   • AThe marketing platform's IP is not in the company's SPF record
   • BThe marketing platform is not using the company's domain in the envelope sender
   • CThe SPF record is missing the 'include' mechanism
   • DThe receiving server does not support SPF
   Reveal Solution Discussion Select an answer first