Email Security

Question 1 of 6

A receiving mail server checks an inbound message and finds that the sending server’s IP address is not listed in the sender domain’s DNS TXT record for authorized mail sources. Which email authentication technology detected this, and what does its record contain?

DKIM — the record contains the public key used to verify the digital signature on the message SPF — the record lists all servers authorized to send email on behalf of the domain; the sending server’s IP is not on that list DMARC — the record specifies the policy action (none/quarantine/reject) when validation fails MX record — the mail exchange record that identifies which servers receive mail for the domain

Question 2 of 6

A domain owner wants to prove that outgoing emails were actually sent from their mail server and that the message content was not altered in transit. Which technology should be configured, and how does the receiving server validate it?

SPF — the receiving server checks whether the sending IP is in the domain’s authorized server list DKIM — the sending server digitally signs outgoing messages with a private key; the receiving server retrieves the public key from a DNS TXT record and validates the signature DMARC — the receiving server checks the DMARC record and applies the quarantine policy to all unsigned messages S/MIME — the user digitally signs each message manually before sending; the recipient validates with the sender’s certificate

Question 3 of 6

An organization deploys SPF and DKIM. Phishing emails claiming to be from their domain are still reaching recipients at other organizations because those organizations’ mail servers do not know what to do when SPF or DKIM fails. Which additional technology addresses this gap?

A mail gateway on the sender’s network — it intercepts outbound phishing attempts before they leave the organization MX record hardening — adding a secure MX record that rejects all inbound mail failing authentication DMARC — a DNS TXT record that tells receiving mail servers what policy to apply (none/quarantine/reject) when SPF or DKIM fails, and sends compliance reports to the domain owner DNS DNSSEC — signing the DNS zone prevents attackers from spoofing the SPF and DKIM records themselves

Question 4 of 6

A security administrator is setting up DMARC for the first time. A colleague recommends starting with p=reject to immediately block all unauthenticated emails. The administrator instead chooses p=none first. Why is the administrator’s approach correct?

p=none provides stronger protection than p=reject because it monitors all traffic without filtering any of it p=none is required by RFC and must always precede any enforcement policy Starting with p=none allows the administrator to receive DMARC aggregate reports and identify all legitimate sending sources before enforcement; jumping to p=reject without this review can accidentally block legitimate email from services not yet in the SPF record p=none prevents spoofed emails from reaching recipients while p=reject only logs them

Question 5 of 6

A company adds a new cloud-based CRM system that sends automated emails on the company’s behalf. Within days, recipients report that these emails are landing in spam. SPF, DKIM, and DMARC are already configured with p=quarantine. What is the MOST likely cause?

DKIM validation is failing because the CRM is modifying email headers, which invalidates the digital signature The CRM’s sending servers are not listed in the company’s SPF DNS TXT record; SPF fails, DMARC applies the quarantine policy, and the emails go to spam The DMARC policy is set too strictly; p=quarantine automatically quarantines all third-party service emails The CRM’s IP address is on a global spam blocklist and cannot be removed by the company

Question 6 of 6

A domain owner reviews their DMARC aggregate reports and discovers that thousands of emails per day are being sent worldwide claiming to be from their domain, but the sending IPs are not in their SPF record and have no DKIM signatures. What is this evidence of, and what DMARC policy change would instruct all receiving mail servers to discard these emails?

This is evidence of a DNS misconfiguration; changing the SPF record to include all IPs would stop the reports This is evidence that the domain is being actively spoofed in a phishing campaign; changing the DMARC policy to p=reject instructs all receiving mail servers to discard messages that fail SPF and DKIM validation This is evidence of a compromised mail server; the organization should rotate their DKIM signing key immediately This is normal internet background noise; DMARC reports always show high volumes of failed messages from unknown IPs

Matching

Match each description to the correct email authentication technology.

1. A DNS TXT record published by the domain owner listing all servers authorized to send email on behalf of the domain; checked by receiving servers against the sending server’s IP address

2. A mechanism where the sending mail server signs outgoing messages with a private key and publishes the corresponding public key in a DNS TXT record for receiving servers to verify

3. An extension of the two other email authentication technologies that specifies the disposal policy (none/quarantine/reject) for failing messages and sends compliance reports to the domain owner

4. The organizational device that acts as the gatekeeper for inbound email, evaluating messages before they reach end users and applying filtering, scanning, and authentication checks

1. 2. 3. 4.

A. SPF

B. DKIM

C. DMARC

D. Mail Gateway

Email Security — Quiz

Matching