What is the main information being sought when examining e-mail headers?

• A. The subject line
• B. The recipient list
• C. The encryption method
• D. The originating e-mail's domain name or an IP address

Answer: (D)

Email headers are used to establish provenance and track the path a message took across servers. The most important information is where the message originated—the originating domain name or IP address—which helps trace the sender and detect spoofing. While the subject, recipient list, and any encryption notes appear in headers, they don’t reliably identify the source. The subject can be forged, the recipient list can be manipulated, and encryption details don’t pinpoint origin. So the main information being sought is the originating e-mail's domain name or an IP address.