CHFI Application, Email and Cloud Forensics Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The email was received via SMTP

  Why it's wrong here

  SMTP is the standard delivery protocol for all email, and even a maliciously spoofed message must traverse SMTP from the sender's mail server to the recipient's. The presence of SMTP headers (e.g., Received) simply proves the message was transmitted normally, not that it is legitimate or fraudulent. Because every email, from every sender, uses SMTP at some point, this observation has no evidentiary value as a spoofing indicator and is fully expected in a normal mail flow.

• ✗

  The email lacks a SPF record in the header

  Why it's wrong here

  The absence of an SPF record in the header only means the receiving server either did not perform an SPF check or the sender's domain published no SPF policy. Many legitimate senders do not implement SPF, so its non-presence is not conclusive proof of spoofing. In contrast, a DKIM signature carrying a mismatched domain represents a cryptographic verification failure, which is far more definitive than a missing policy check and cannot be explained away by sender configuration choices.

• ✗

  The email originated from IP 192.168.1.100

  Why it's wrong here

  An originating IP address of 192.168.1.100 is a private, RFC1918 address, which is common for internal mail gateways or messages sent from a corporate LAN. The IP alone does not authenticate the sender's identity, and header IPs can be altered or misleading, especially if a mail server is behind NAT or a proxy. Therefore, the IP address is context-dependent and not a strong indicator of spoofing, whereas a DKIM domain mismatch is an explicit authentication failure tied to the signing domain.

• ✓

  The DKIM signature domain is evil.com, not paypal.com

  Why this is correct

  A valid DKIM signature verified under the domain 'evil.com' while the From header claims 'paypal.com' is a definitive spoofing indicator. The 'd=' tag in the DKIM signature identifies which domain's private key signed the message, and Paypal's private key is cryptographically inaccessible to an attacker. Under DMARC alignment, the signing domain must match the From domain (or be an organizational parent), so this mismatch proves the message was not authorized by Paypal and is a direct sign of forgery, much stronger than SMTP or SPF observations.

Go deeper

Related to this question