Final quiz — Email Authentication Fundamentals

The name and address shown in a user's inboxThe Return-Path address used for bounces, set during the SMTP conversationThe domain that signed the message with DKIMThe subject line of the message

SMTP requires the envelope and header From: to matchSpoofing is technically impossible without a compromised mail serverNothing in base SMTP requires the envelope sender and the visible header From: to matchDNS blocks any mismatch automatically

Hardfail — reject anything not explicitly authorizedSoftfail — treat unauthorized senders as suspicious, but don't reject outrightNeutral — this qualifier has no real effectInclude every possible sending server automatically

5 lookups — rarely an issue in practice10 lookups — exceeding it causes SPF to return permerror and stop being evaluated20 lookups — only relevant for enterprise domainsThere is no limit on SPF lookups

The envelope MAIL FROM domainWhether the sending IP is authorizedThe visible header From: address a person actually readsThe SPF record's DNS TXT syntax

The date the message was sentThe signing domain vouching for the message's contentThe receiving mail serverThe DMARC policy in effect

In the message headers themselvesAt a DNS TXT record built from a selector, e.g. selector._domainkey.example.comIn the SPF recordIt isn't published; it's requested over SMTP

That every message be encrypted end to endThat a passing SPF or DKIM result's domain aligns with the visible header From: domainThat SPF and DKIM both fail before a message is trustedThat the sending IP be on an allowlist

p=none actually rejects all unauthenticated mailp=none only enables reporting — nothing is quarantined or blocked yetp=none is not a valid DMARC policy valuep=none only works for DKIM, not SPF

The message was definitely malicious and should be investigated firstThe current policy took no enforcement action on a message that failed SPF — worth checking if it's a legitimate sender you haven't authorized yetDMARC itself is brokenThe report is corrupted and should be ignored

p=none is sufficientNo DMARC record is required at allp=quarantine or p=reject — enforcement, not just monitoringBIMI has no relationship to DMARC policy

It's the smallest possible file formatIt's a restricted, script-free profile of SVG safe to render inside untrusted mail clientsIt's required only for animated logosAny SVG file works equally well; the format doesn't matter