Email Forensics: Headers, Authentication, and Phishing
Published:
Questions
30
Duration
30 min
Faculty-reviewed
30
Updated
28 Apr 2026
About this mock
This mock covers email forensics — header analysis, sender authentication (SPF, DKIM, DMARC), spoofing techniques and how to detect them, phishing investigation, business email compromise (BEC), and the legal framework for email-based offences in India. Thirty questions test what every header field means and how to read it, how SPF / DKIM / DMARC verdicts appear in Authentication-Results, the difference between display-name spoofing and full envelope forgery, how to trace a phishing campaign back to its kit and infrastructure, attachment forensics (MIME, Base64, hash matching to MITRE ATT&CK and VirusTotal), and the prosecution handles under IT Act Sections 66C, 66D and BNS Section 318.
It is pitched at BSc and first-year MSc cyber forensics students, FACT and UGC-NET aspirants, and incident-response analysts at Indian SOCs and CERT-In-affiliated teams. Email is the single largest entry vector for cyber-crime complaints registered on the National Cyber Crime Reporting Portal; every cyber-crime cell sees dozens of email cases per week, which makes mastering this area one of the highest-leverage investments for any cyber forensics student.
Topics covered:
- Email header anatomy: Received, Message-ID, Return-Path, Reply-To, From, Date, X-Originating-IP
- SMTP / IMAP / POP3 — what each protocol does, the standard ports, and what trace each leaves
- SPF (RFC 7208), DKIM (RFC 6376), DMARC (RFC 7489), ARC (RFC 8617), BIMI
- Header spoofing vs envelope spoofing; how From and Return-Path can disagree
- Display-name attacks, IDN homograph attacks vs ASCII typosquats, lookalike-domain detection
- Phishing kit fingerprinting and OSINT pivots from a phishing URL (WHOIS, DNS, ASN, crt.sh)
- Attachment forensics: MIME structure, Base64, hash-to-malware-family lookup
- Email storage formats: EML, MSG, PST, OST, MBOX — what each is and how to parse
- Indian legal handle: IT Act Sections 66C (identity theft), 66D (cheating by personation), BNS Section 318
- Operational response: 1930 helpline, cybercrime.gov.in, the CFCFRMS golden-hour fund-hold mechanism
Each question carries a detailed explanation citing the relevant RFC verbatim, NIST SP 800-86 for incident-response procedure, MITRE ATT&CK for technique mappings, the IT Act for the Indian legal handle, and Microsoft / Google admin documentation for header behaviour. Allow 30 minutes; the explanations are long enough to use as study notes by themselves.
Sources & references
Questions in this mock are written and verified against the following sources. Citations are recorded per question and shown in the explanation after submission.
- cited in 6 questions
RFC 5322 — Internet Message Format
Section 3.6.2: Originator Fields (display-name and addr-spec)
Open source - cited in 3 questions
RFC 5321 — Simple Mail Transfer Protocol
Section 2.3.5: Service Extensions and IANA port assignments
Open source - cited in 2 questions
- cited in 2 questions
NIST SP 800-86 — Guide to Integrating Forensic Techniques into Incident Response
Section 5: Analyzing Application Data
Open source - cited in 1 question
SANS — OSINT Techniques for Phishing Investigation
Pivoting from a phishing URL using WHOIS, DNS, ASN and TLS certificate transparency
Open source - cited in 1 question
BIMI Group — BIMI Implementation Guide
BIMI requirements: DMARC enforcement and Verified Mark Certificate
Open source - cited in 1 question
- cited in 1 question
- cited in 1 question
RFC 8617 — Authenticated Received Chain (ARC) Protocol
Section 1: Introduction (problem statement)
Open source - cited in 1 question
- cited in 1 question
- cited in 1 question
RFC 5891 — Internationalized Domain Names in Applications (IDNA)
Section 4: Registration Validity (homograph mitigation)
Open source - cited in 1 question
FBI Internet Crime Complaint Center (IC3) — BEC Annual Reports
Business Email Compromise (BEC) typology and impact statistics
Open source - cited in 1 question
Microsoft Learn — Anti-spam Message Headers
X-Originating-IP and provider-specific header behaviour
- cited in 1 question
- cited in 1 question
MITRE ATT&CK — T1566 Phishing
T1566.001 (Spearphishing Attachment), T1566.002 (Spearphishing Link)
Open source - cited in 1 question
RFC 8601 — Message Header Field for Indicating Message Authentication Status
Section 2.2: Authentication-Results Header Field
Open source - cited in 1 question
Indian Cyber Crime Coordination Centre (I4C) — National Cyber Crime Reporting Portal
Citizen Financial Cyber Fraud Reporting and Management System (CFCFRMS) and 1930 helpline
Open source - cited in 1 question
RFC 7489 — Domain-based Message Authentication, Reporting and Conformance (DMARC)
Section 3.1: Identifier Alignment
Open source - cited in 1 question
RFC 6376 — DomainKeys Identified Mail (DKIM) Signatures
Section 3.5: The DKIM-Signature Header Field
Open source - cited in 1 question
RFC 2045 — Multipurpose Internet Mail Extensions (MIME) Part One
Section 2: Definitions, Conventions, and Generic BNF Grammar
Open source
How our mocks are built
Questions are written and edited by the ForensicSpot team and cited from peer-reviewed forensic textbooks, official syllabi and primary case law. Each one is verified before publishing. Detailed explanations show after you submit, so the test stays a real test. See a mistake? Tell us.
Common questions
What does the Email Forensics: Headers, Authentication, and Phishing mock cover?+
This mock covers email forensics — header analysis, sender authentication (SPF, DKIM, DMARC), spoofing techniques and how to detect them, phishing investigation, business email compromise (BEC), and the legal framework for email-based offences in India. Thirty questions test what every header field means and how to read it, how SPF / DKIM / DMARC verdicts appear in Authentication-Results, the difference between display-name spoofing and full envelope forgery, how to trace a phishing campaign bac
How many questions and how long is the test?+
30 multiple-choice questions, 30 minutes total. Difficulty: easy. Tier: Premium.
Who is this mock for?+
Forensic science students and aspirants who want timed, exam-style practice with explanations and verified source citations on Digital Forensics. Useful for postgraduate entrance preparation and for BSc / MSc forensic students testing their recall under time.
Are the questions reviewed?+
Yes — 30 of 30 questions are faculty-reviewed. Each question carries a verified source citation.
Do I need an account to take this mock?+
Yes, a free ForensicSpot account is required to start a timed attempt — this lets you save progress, see per-question explanations after submission, and track your topic-level performance over time.