DKIM-Signature Header: Purpose in Email Forensics
Which of the following email headers is used to verify the domain of the sending server and is commonly used for authentication to prevent spoofing?
Quick Answer
The DKIM-Signature header is the correct choice because it provides a cryptographic signature that authenticates the domain of the sending server and ensures message integrity, directly preventing spoofing. When an email is sent, the outgoing mail server signs the message with a private key, and the receiving server retrieves the corresponding public key from the domain’s DNS records to verify that the email was not altered in transit and genuinely originates from the claimed domain. On the Computer Hacking Forensic Investigator CHFI exam, this concept tests your understanding of email forensics and authentication mechanisms, often appearing in questions about header analysis to trace spoofed or phishing emails. A common trap is confusing DKIM with SPF or DMARC—remember that DKIM focuses on a digital signature tied to the domain, not just IP authorization. Memory tip: think “DKIM = Digital Key Integrity Match,” linking the signature to domain verification.
⚠ Common exam trap
EC-Council often tests the distinction between headers used for authentication (DKIM-Signature) versus headers used for routing or metadata (Received, X-Mailer), leading candidates to mistakenly choose Received because it shows server hops, but it does not verify domain ownership.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DKIM-Signature
DKIM-Signature is the correct answer because it is an email authentication method that uses a digital signature to verify the domain of the sending server. It allows the receiver to check that the email was not forged or altered during transit, directly preventing domain spoofing. This header is defined in RFC 6376 and is a core component of email authentication frameworks like DMARC.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Content-Type
Why it's wrong here
Content-Type specifies the MIME type of the message body.
- ✗
Received
Why it's wrong here
The Received header tracks the path of the email but does not provide domain verification.
- ✗
X-Mailer
Why it's wrong here
X-Mailer identifies the email client software, not authentication.
- ✓
DKIM-Signature
Why this is correct
DKIM-Signature provides a digital signature for domain verification.
Go deeper
Related to this question
About these practice questions
This CHFI question is part of Courseiva's 205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on CHFI
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which email header field is used to verify that an email was sent by the authorized mail server for the domain and has not been tampered with, using cryptographic signatures?
easy- A.X-Mailer
- B.Message-ID
- C.Received-SPF
- ✓ D.DKIM-Signature
Why D: DKIM (DomainKeys Identified Mail) uses a digital signature to verify the email's origin and integrity.
Variation 2. Which email header field is specifically used to verify that an email was not tampered with during transit and is signed by the sender's domain?
easy- A.X-Originating-IP
- B.Message-ID
- C.Received
- ✓ D.DKIM-Signature
Why D: The DKIM-Signature header field is the correct answer because it provides a cryptographic signature that allows the receiver to verify that the email was not altered in transit and that it originated from the claimed domain. DKIM (DomainKeys Identified Mail) uses public-key cryptography, where the sender's domain publishes a public key in DNS, and the sending server signs the email with the corresponding private key. This ensures both integrity and domain-level authentication, directly matching the question's requirement.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.