Having received a targeted attack from a spoofed email domain, a company wants to take advantage of DKIM validation for inbound mail. The messaging administrator has enabled sender authentication and DKIM validation and now needs to configure a content filtering policy to quarantine any messages that fail. Which condition should be met for the content filtering policy to fire?

Question

Quizplus · Accepted Answer

The message header contains "dkim=fail" is the correct condition to check for DKIM validation failures, as DKIM results are typically included in the email headers.

Having Received a Targeted Attack from a Spoofed Email Domain