In an email header, what information should never be trusted?

Question

Options

• AReceived: Headers
• BReverse DNS info on sending machine
• CTimestamps
• DThe "message from" field

• A
  15% (9)
• B
  3% (2)
• C
  7% (4)
• D
  75% (45)

Explanation

The "message from" field (the From: header) is controlled entirely by the sender and can be set to any arbitrary value - it carries no cryptographic verification by default, making it trivially easy to spoof in phishing attacks. The Received: headers (A) are added by each mail server that handles the message and, while the outermost one can be forged, the chain added by your own mail server is generally trustworthy for tracing the actual path. Reverse DNS on the sending machine (B) is independently queried by the receiving server and not supplied by the sender, giving it more inherent credibility. Timestamps (C) can be skewed but are usually accurate enough to be useful and are less of a security concern than identity spoofing. Memory tip: Think "From = Fake" - the From field is just a label the sender writes themselves, like writing any name you want in the return address slot on a paper envelope.

No community discussion yet for this question.