CHFI Application, Email and Cloud Forensics Practice Question
In an email header, which field typically contains the IP address of the original sending client?
⚠ Common exam trap
EC-Council often tests the misconception that the 'Return-Path' field contains the sender's IP address, when in fact it only holds the email address for bounce handling, not any network-layer information.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Received
The 'Received' field in an email header is added by each mail transfer agent (MTA) that processes the message, and the first 'Received' header (at the bottom of the header block) typically contains the IP address of the original sending client (the SMTP client that initiated the connection). This field records the 'from' IP and the 'by' host, making it the definitive source for tracing the origin of the email.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Return-Path
Why it's wrong here
Return-Path is generated by the SMTP envelope's MAIL FROM command and is used to route bounce messages back to the sender. It contains only a reverse-path mailbox address, never the IP address of the client. In forensic email analysis, it can reveal the original envelope sender but not the sending host.
- ✗
Message-ID
Why it's wrong here
Message-ID is a formatting header created by the mail user agent or first mail server to uniquely identify a message, typically using a global unique identifier with a domain suffix (e.g., <timestamp@example.com>). It is meant for message threading and caching, not for network trace. Although it contains the sending domain, the actual IP address of the sending client is not present in this field.
- ✓
Received
Why this is correct
The Received header is inserted by every SMTP server that handles the message, and each line records the IP address of the transmitting host, the receiving server, protocol information, and a timestamp. The bottommost Received line is the first one added, showing the connection from the originating client or its final relay. Therefore, forensically it is the go-to field for discovering the sending IP address.
- ✗
DKIM-Signature
Why it's wrong here
DKIM-Signature is an authentication header that contains a canonicalized digital signature for message integrity, with tags such as d= for signing domain, s= for selector, and b= for signature data. It never contains the sender's IP address because its purpose is to bind the message to an email domain, not to the transport path. While DNS queries for the signing domain might reveal IP addresses, the header itself remains IP-free.
Go deeper
Related to this question
About these practice questions
One of 205 original CHFI practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.