CHFI Application, Email and Cloud Forensics Practice Question
Which email header field is specifically used to verify that an email was not tampered with during transit and is signed by the sender's domain?
⚠ Common exam trap
A common misconception is that the Received header can verify integrity because it shows the mail path, but it lacks cryptographic signing and can be manipulated by any intermediate server. EC-Council expects you to know that only DKIM provides cryptographic integrity verification tied to the sender's domain.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DKIM-Signature
The DKIM-Signature header field is the correct answer because it provides a cryptographic signature that allows the receiver to verify that the email was not altered in transit and that it originated from the claimed domain. DKIM (DomainKeys Identified Mail) uses public-key cryptography, where the sender's domain publishes a public key in DNS, and the sending server signs the email with the corresponding private key. This ensures both integrity and domain-level authentication, directly matching the question's requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
X-Originating-IP
Why it's wrong here
This header, often added by webmail or mail clients, records the IP address from which the sender connected. However, it is a plaintext informational field that can be spoofed or forged by a malicious sender, and it does not include any cryptographic hash or authentication mechanism. Therefore, while it may provide investigative leads about the originating network, it cannot verify the message integrity or confirm that the content has not been altered in transit.
- ✗
Message-ID
Why it's wrong here
Message-ID serves as a globally unique identifier generated by the sending mail client or server to help trace email threads and deduplicate messages. It carries no cryptographic signature or integrity check, so its value can be set arbitrarily by the sender and does not bind to the message body in any verifiable way. Thus, an attacker can modify the message content without affecting the Message-ID, making it completely unsuitable for confirming that the email has not been altered.
- ✗
Received
Why it's wrong here
The Received header chain records the path an email traversed, with each mail server adding a timestamp and server identity as the message is relayed. This hop-by-hop trace is metadata about routing, not a cryptographic guarantee of content integrity, and intermediate servers can (and per RFC 5321 often do) modify the header set, sometimes deliberately. Consequently, while Received fields help identify relay hosts and potential abuse, they cannot prove the body was not tampered with during transit.
- ✓
DKIM-Signature
Why this is correct
DKIM-Signature contains a digital signature computed over selected canonicalized header fields and the message body using a private key held by the sending domain. The verifier retrieves the sender's public key from DNS (e.g., dkim._domainkey.example.com) to decrypt the hash and compare it to the hashed current content, thereby detecting any modification since signing. Because the signature is cryptographically bound to the message content and the signing domain, it specifically provides the required verification of both origin and integrity.
Quick reference
Asymmetric Encryption Algorithm Comparison
| Algorithm | Key Exchange | Signatures | Equivalent Security Key | Notes |
|---|---|---|---|---|
| RSA-3072 | Yes | Yes | 128-bit | Widely deployed; slow for bulk data |
| ECDSA P-256 | No | Yes | 128-bit | Fast signatures; standard TLS certs |
| ECDH / ECDHE | Yes | No | 128-bit | Perfect forward secrecy in TLS 1.3 |
| DH / DHE | Yes | No | 128-bit (3072-bit key) | Replaced by ECDHE in modern TLS |
| Ed25519 | No | Yes | ~128-bit | SSH keys, modern PKI |
Go deeper
Related to this question
About these practice questions
This CHFI question is part of Courseiva's 205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.