Generally, which header is used to reveal reliable information from forged emails:

Question

Options

• AReply-to header
• BReturn-receipt-to header
• CReceived header
• DComments header

• A
  9% (5)
• B
  4% (2)
• C
  72% (39)
• D
  15% (8)

Explanation

The Received header is the most reliable source of genuine routing information in an email because it is appended by each mail server that handles the message in transit - these servers are independent infrastructure that forgers cannot control or retroactively alter. While a malicious sender can freely fabricate the From, Reply-To, Return-Receipt-To, and Comments headers (all of which are written by the sender's client and require no verification), the Received chain is written by the servers themselves, making it the forensic trail investigators use to trace an email's true origin.

• A (Reply-To): Set by the sender to redirect replies - trivially forged and meaningless for authentication.
• B (Return-Receipt-To): A non-standard header requesting delivery confirmation, also sender-controlled and easily faked.
• D (Comments): A free-form human-readable field with no routing function and zero authenticity guarantee.

Memory tip: Think of Received headers like passport stamps - each border control (mail server) adds its own stamp as the message passes through, and those stamps can't be pre-printed by the traveler.

No community discussion yet for this question.