Which content filter condition checks to see if the "From: header" in the message is similar to any of the users in the content dictionary?

Question

Options

• ASPF Verification
• BDuplicate Boundaries Verification
• CForged Email Detection
• DSubject Header

• A
  3% (1)
• C
  92% (33)
• D
  6% (2)

Explanation

The Forged Email Detection content filter condition specifically compares the display name or email address in the 'From:' message header against entries in a content dictionary. This is used to detect spoofed or forged sender identities - for example, if an attacker sends an email appearing to come from a CEO whose name is listed in the dictionary. SPF Verification checks whether the sending mail server's IP is authorized in the domain's DNS SPF record - it does not inspect message headers against a dictionary. Duplicate Boundaries Verification looks for malformed MIME boundary structures, which can indicate evasion attempts. Subject Header filtering matches patterns in the subject line, not the From: address. Only Forged Email Detection is designed to compare the From: header against a dictionary of known users.

No community discussion yet for this question.