Clues that a "Received:" header has been forged include all but one of the following:

Question

Options

• AInvalid IP address
• BInvalid host names
• CInvalid Subject line
• DInvalid format

• A
  4% (1)
• B
  12% (3)
• C
  80% (20)
• D
  4% (1)

Explanation

Option C is correct because the Subject line is an entirely separate email header - it has no relationship to the Received: header chain. Whether the Subject is odd, missing, or malformed tells you nothing about whether the routing/transfer headers were tampered with.

Why the distractors are wrong (i.e., they ARE valid forgery clues):

• A (Invalid IP address): Received: headers record the IP addresses of servers that relayed the email. A non-routable, private, or nonsensical IP in that chain is a red flag.
• B (Invalid host names): Each hop includes a hostname; hostnames that don't resolve in DNS or don't match the IP are strong indicators of forgery.
• D (Invalid format): Received: headers follow a strict RFC-defined format (from ... by ... with ... id ... for ...). Malformed syntax suggests manual fabrication.

Memory tip: Think of the Received: header as a chain of custody - you check the IPs, hostnames, and format of that chain for breaks. The Subject line belongs to a completely different part of the email envelope and is irrelevant to tracing the delivery path.

No community discussion yet for this question.