ITPEC FE Morning April 2021 Question 43
Which of the following is an appropriate description concerning Sender Policy Framework (SPF) for email communication?
Explanation
It checks the sending server's IP address against the domain's DNS information — SPF is a sender domain authentication mechanism for email.
The owner of a domain publishes an SPF record, a DNS TXT record listing the IP addresses of the mail servers allowed to send mail for it. A receiving server takes the domain from the envelope sender (MAIL FROM), looks up that record in DNS, and checks whether the connecting server's IP address is on the list. On a mismatch the message can be rejected or marked as suspect.
Answer (c)
Why not others:
- •(a) — a department's rule about who sends mail is an internal policy, not an email protocol
- •(b) — mail from a spoofed address is the threat SPF is designed to detect, not SPF itself
- •(d) — addressing one recipient instead of many has nothing to do with sender authentication
Key rule: SPF authenticates the sending server's IP address, DKIM signs the message with a key published in DNS, and DMARC tells receivers what to do when these checks fail.
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.