CHFI Application, Email and Cloud Forensics Practice Question
An email forensic analyst receives a suspicious email and wants to trace its origin. Which email header field provides the most reliable information about the IP address of the sending SMTP server?
⚠ Common exam trap
The EC-Council CHFI exam often tests the misconception that X-Originating-IP is the most reliable source because it appears to directly show the sender's IP, but candidates must remember it is a non-standard header that can be easily forged or omitted, whereas the 'Received' header chain is a mandatory, traceable part of the SMTP protocol.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Received
The 'Received' header is the most reliable source for tracing the origin of an email because each SMTP server that handles the message adds a new 'Received' header at the top, recording the IP address of the sending server (from the HELO/EHLO handshake) and the receiving server. The bottommost 'Received' header typically contains the IP address of the original sending SMTP server, as it is added by the first receiving MTA. This field is standardized in RFC 5321 and is the primary forensic artifact for email source identification.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Return-Path
Why it's wrong here
The Return-Path header, also called the envelope sender, is used by the SMTP protocol to indicate where bounce messages (non-delivery reports) should be sent. It is set by the sender's MTA or the mail delivery system and typically contains an email address, not an IP address or routing path. Because it does not record any information about the server that transmitted the message, it is completely unsuitable for identifying the sending server's IP address.
- ✓
Received
Why this is correct
The Received header is the standard, reliable source for tracing the sending server's IP address in email forensics. Each SMTP server that handles the message adds a Received header that records the IP address (and often the hostname) of the server from which it received the message, along with a timestamp. The first Received header (reading from the bottom of the message) identifies the original sender's server, while each subsequent header documents each hop in the delivery chain. These headers are added automatically by mail servers and are much more difficult to spoof than user-controlled headers, making them the primary evidence for IP identification.
- ✗
DKIM-Signature
Why it's wrong here
The DKIM-Signature header is part of the DomainKeys Identified Mail signing system, which uses a cryptographic signature to authenticate the message's domain and protect against tampering. It contains parameters such as d= (signing domain) and s= (selector) but does not include the IP address of the sending server or any intermediate relay. While DKIM can validate that a message came from a domain authorized to send it, it cannot be used to trace the physical server's IP address, because the signature only proves domain ownership, not the specific IP path taken.
- ✗
X-Originating-IP
Why it's wrong here
X-Originating-IP is an unofficial, non-standardized header sometimes inserted by webmail services or user-facing email clients to record the IP address of the machine used to compose the message. Because it is not added by an SMTP relay as part of the standard mail-exchange process, it can be easily omitted, altered, or completely forged by a malicious sender. In contrast, Received headers are automatically appended by each mail server that handles the message, creating a verifiable chain of custody, so X-Originating-IP should only be considered as a lead, never as a primary or definitive source for the sending server's IP address.
Go deeper
Related to this question
About these practice questions
One of 205 original CHFI practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.