CHFI Application, Email and Cloud Forensics Practice Question
Which of the following email authentication protocols uses a digital signature to verify the sender's domain and that the email has not been tampered with?
⚠ Common exam trap
A common trap in the EC-CHFI exam is that candidates confuse STARTTLS's transport-layer encryption with message-level authentication, leading them to pick D instead of the correct digital signature protocol.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DKIM
DKIM (DomainKeys Identified Mail) is the correct answer because it uses a digital signature (an encrypted hash) added to the email header, which is verified against a public key published in the sender's DNS TXT record. This cryptographic process confirms that the email originated from the claimed domain and that the message body and key headers have not been altered in transit, ensuring integrity and authenticity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DMARC
Why it's wrong here
DMARC does not generate a digital signature; it is a policy framework that instructs receiving mail servers on how to handle messages that fail SPF and DKIM checks. It relies on domain alignment, comparing the RFC5322.From domain against the domains used by passing SPF or DKIM, and publishes a policy (p=none/quarantine/reject) in DNS. Because DMARC consumes the results of SPF and DKIM rather than adding any cryptographic signature itself, it is not the protocol being described.
- ✓
DKIM
Why this is correct
DKIM (DomainKeys Identified Mail) is the protocol that adds a digital signature to email headers, specifically a DKIM-Signature header containing a base64-encoded signature. The signing domain uses its private key to sign selected header fields and the message body, while the receiving MTA retrieves the public key via a TXT record in DNS (e.g., selector._domainkey.example.com) and verifies the signature. This cryptographically ties the message to the domain and ensures the signed content was not altered in transit.
- ✗
SPF
Why it's wrong here
SPF (Sender Policy Framework) does not use a digital signature at all; it is an IP-based authentication method. The domain owner publishes a TXT record listing the IP addresses or hosts permitted to send mail for that domain, and the receiving MTA checks whether the connecting server's IP appears in that list. SPF validates the MAIL FROM envelope header, not the message body or From header, so it proves the sending server is authorized by the domain but provides no end-to-end integrity protection.
- ✗
STARTTLS
Why it's wrong here
STARTTLS is an SMTP command used to upgrade a plaintext connection to an encrypted TLS session, protecting the message in transit from eavesdropping or tampering. It is not an authentication protocol because it neither signs the message nor verifies the sender's domain; it only negotiates opportunistic encryption between two mail servers. Even if a connection is encrypted via STARTTLS, the email could still be forged because no identity verification is inherently tied to the cipher.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CHFI question from scratch — 205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.