I85PREP
⌘ K
PCES study materials
PCES study resources

PCES practice questions

One question at a time. Build your PCES understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Email Authentication and Domain Protection (SPF, DKIM, DMARC)

Which DNS record type is used to publish an SPF policy for a domain?

  1. TXT Correct answer.
  2. SRV
  3. MX
  4. CNAME

Explanation

SPF policies are published as TXT records whose content begins with the version tag v=spf1. Receiving mail servers retrieve this TXT record during the SMTP transaction to evaluate the sending IP.

Question 2Email Authentication and Domain Protection (SPF, DKIM, DMARC)

In an SPF record, what does the mechanism 'include:_spf.example.net' instruct a receiver to do?

  1. Require DKIM signing by _spf.example.net before accepting the message
  2. Recursively evaluate the SPF policy of _spf.example.net and use its result Correct answer.
  3. Add the A record of _spf.example.net to the permitted sender list
  4. Replace the current domain's SPF policy with the one at _spf.example.net

Explanation

The include mechanism performs a recursive SPF check against the named domain and adopts the outcome of that check. If the included domain returns a pass, the including domain also passes at that mechanism.

Question 3Email Authentication and Domain Protection (SPF, DKIM, DMARC)

Which DKIM tag in the signature header identifies the selector used to locate the public key?

  1. s= Correct answer.
  2. d=
  3. h=
  4. b=

Explanation

The s tag names the selector, which is combined with the d domain to form the DNS query name, for example selector._domainkey.example.com. The d tag supplies the signing domain portion of that lookup.

Question 4Email Authentication and Domain Protection (SPF, DKIM, DMARC)

A DMARC policy record is published at which DNS name?

  1. _dmarc.example.com Correct answer.
  2. dmarc.example.com
  3. example.com._dmarc
  4. _domainkey.example.com

Explanation

DMARC policies are published as a TXT record at the reserved subdomain _dmarc prepended to the organizational or policy domain. Receivers query this exact name to obtain p, rua, ruf, and related tags.

Question 5Email Authentication and Domain Protection (SPF, DKIM, DMARC)

What does an SPF qualifier of '-all' at the end of a record signify?

  1. IPs not matched by earlier mechanisms are a hard fail Correct answer.
  2. IPs not matched by earlier mechanisms receive a neutral result
  3. Only the listed IPs may send, and others get a soft fail
  4. The record is syntactically invalid and must be ignored

Explanation

The minus qualifier produces a fail result for any sender not matched by preceding mechanisms. Receivers commonly treat fail as a strong indication the message is not authorized.

Question 6Email Authentication and Domain Protection (SPF, DKIM, DMARC)

Which header domain does DMARC use as the alignment reference for SPF and DKIM?

  1. The SMTP MAIL FROM envelope domain
  2. The RFC5322.From header domain Correct answer.
  3. The topmost Received header domain
  4. The Message-ID domain

Explanation

DMARC alignment is evaluated against the domain in the visible From header, which users see. A DMARC pass requires a passing SPF result with an aligned MAIL FROM domain or a passing DKIM result with an aligned signing domain.

Question 7Email Authentication and Domain Protection (SPF, DKIM, DMARC)

A DKIM public key for selector 'mail' on example.com is published at which DNS name?

  1. _dkim.mail.example.com
  2. _domainkey.mail.example.com
  3. mail._domainkey.example.com Correct answer.
  4. mail.dkim.example.com

Explanation

DKIM key records place the selector before the fixed label _domainkey and the signing domain after it. The resulting name is selector._domainkey.domain.

Question 8Email Authentication and Domain Protection (SPF, DKIM, DMARC)

What is the primary purpose of DMARC reporting tags rua and ruf?

  1. rua requests forensic reports while ruf requests aggregate reports
  2. rua sets the policy for subdomains while ruf sets the policy for the organizational domain
  3. rua requests aggregate reports while ruf requests failure or forensic reports Correct answer.
  4. rua lists authorized senders while ruf lists authorized receivers

Explanation

The rua tag specifies where receivers send aggregate XML reports summarizing many messages. The ruf tag specifies where individual failure reports are sent when a message fails DMARC evaluation.

Question 9Email Authentication and Domain Protection (SPF, DKIM, DMARC)

An SPF record contains more than ten DNS-querying mechanisms and includes. What result should a compliant receiver return?

  1. neutral
  2. permerror Correct answer.
  3. softfail
  4. temperror

Explanation

SPF limits the number of DNS-querying terms such as include, a, mx, ptr, and exists to ten per evaluation. Exceeding the limit is a permanent configuration error, reported as permerror.

Question 10Email Authentication and Domain Protection (SPF, DKIM, DMARC)

A message is DKIM-signed with d=example.com and passes DKIM verification, but the visible From header shows [email protected]. With a DMARC policy at example.org using relaxed alignment, what is the DKIM alignment outcome?

  1. Aligned, because relaxed alignment ignores the domain entirely
  2. Not aligned, because example.com does not match the organizational domain example.org Correct answer.
  3. Not aligned, because the selector does not match the From local part
  4. Aligned, because any passing DKIM signature satisfies DMARC

Explanation

Relaxed DKIM alignment requires the DKIM d domain to share the same organizational domain as the From header domain. example.com and example.org are different organizational domains, so the signature is not aligned.

Question 11Email Authentication and Domain Protection (SPF, DKIM, DMARC)

A domain publishes 'v=spf1 a mx -all' and also sends mail through a marketing platform whose IPs are not in its A or MX records. What is the most direct fix within SPF?

  1. Add an include or ip4 mechanism covering the platform's sending IPs Correct answer.
  2. Change -all to ?all so unmatched senders are neutral
  3. Publish a second SPF TXT record with the platform's IPs
  4. Remove the mx mechanism to free a DNS lookup

Explanation

Authorized sending sources must be represented by mechanisms in the single SPF record. Adding an include for the provider's SPF domain or explicit ip4/ip6 mechanisms authorizes those senders.

Question 12Email Authentication and Domain Protection (SPF, DKIM, DMARC)

A DMARC record specifies p=none with rua pointing to a monitoring address. What behavior does this policy request from receivers?

  1. Apply the organizational domain's policy instead of this one
  2. Reject failing messages and send failure reports
  3. Quarantine failing messages and send aggregate reports
  4. Take no action on failing messages but send aggregate reports Correct answer.

Explanation

p=none is a monitoring-only policy that asks receivers to deliver failing messages normally while reporting on them. It is typically used during rollout to observe authentication results before enforcing.

Question 13Email Authentication and Domain Protection (SPF, DKIM, DMARC)

Which condition causes an SPF temperror rather than a permerror?

  1. The record contains two version tags
  2. The record exceeds the ten-lookup limit
  3. The record contains an unrecognized mechanism name
  4. A DNS lookup for an included domain times out during evaluation Correct answer.

Explanation

temperror reflects a transient condition such as a DNS timeout or server failure that may resolve on retry. Permanent syntax or limit problems produce permerror instead.

Question 14Email Authentication and Domain Protection (SPF, DKIM, DMARC)

An organization wants subdomains without their own DMARC record to be rejected while the organizational domain stays at p=none. Which tag accomplishes this?

  1. adkim=s
  2. sp=reject Correct answer.
  3. fo=1
  4. p=reject

Explanation

The sp tag sets a separate policy for subdomains of the organizational domain. Setting sp=reject while p=none keeps the apex in monitoring mode but enforces rejection on subdomains.

Question 15Email Authentication and Domain Protection (SPF, DKIM, DMARC)

Which header field is hashed as part of the DKIM signature when it appears in the h= tag?

  1. Every header field in the message regardless of the h= tag
  2. The named header field instances selected per DKIM canonicalization and signing rules Correct answer.
  3. Only the body of the message
  4. Only the SMTP envelope recipient list

Explanation

The h tag lists the header fields covered by the signature, and the signer hashes the selected instances according to the specified canonicalization. Headers not listed are unprotected.

Question 16Email Authentication and Domain Protection (SPF, DKIM, DMARC)

What does the DKIM body hash tag bh= contain?

  1. The list of headers excluded from signing
  2. A base64-encoded hash of the canonicalized body Correct answer.
  3. A base64-encoded copy of the private key
  4. The selector used to find the public key

Explanation

bh carries the digest of the canonicalized message body so the verifier can confirm body integrity. It is computed with the hash algorithm named in the alg tag.

Question 17Email Authentication and Domain Protection (SPF, DKIM, DMARC)

A sender's SPF record uses 'v=spf1 ptr -all'. Why do many operators discourage the ptr mechanism?

  1. It always returns a hard fail for IPv6 addresses
  2. It is slow and unreliable because it depends on reverse DNS that senders often do not control Correct answer.
  3. It is not defined in the SPF specification at all
  4. It consumes no DNS lookups and therefore hides misconfigurations

Explanation

The ptr mechanism performs reverse DNS lookups and validates forward-confirmed names, which is slow and fragile. Many receivers ignore or deprioritize ptr, and the SPF specification discourages its use.

Question 18Email Authentication and Domain Protection (SPF, DKIM, DMARC)

A receiver sees a DMARC pass from SPF alignment while DKIM fails. What does DMARC conclude?

  1. The message is quarantined regardless of the policy tag
  2. The message is rejected because DKIM failure overrides SPF
  3. The message passes DMARC because at least one aligned authentication method passed Correct answer.
  4. The message fails DMARC because both methods must pass

Explanation

DMARC passes when either SPF or DKIM produces a pass that is aligned with the From domain. Both are not required, so one aligned pass is sufficient.

Question 19Email Authentication and Domain Protection (SPF, DKIM, DMARC)

A company delegates a subdomain to a third-party SaaS provider that sends mail as that subdomain. Which approach best preserves DMARC protection for the parent domain?

  1. Remove the subdomain's MX records to prevent spoofing
  2. Add a wildcard SPF include for all provider domains at the apex
  3. Publish a DMARC record on the delegated subdomain with an appropriate policy and reporting Correct answer.
  4. Set the apex DMARC policy to p=none permanently

Explanation

A subdomain with its own DMARC record controls its own policy and reporting, isolating third-party sending from the parent. Without such a record the subdomain inherits the organizational policy, which may not fit the provider's needs.

Question 20Email Authentication and Domain Protection (SPF, DKIM, DMARC)

Why is DKIM alone insufficient to prevent visible From header spoofing?

  1. DKIM validates a signature but does not require the signing domain to match the From domain Correct answer.
  2. DKIM only signs the SMTP envelope sender address
  3. DKIM signatures are stripped by all receiving mail servers
  4. DKIM keys expire after twenty-four hours by default

Explanation

DKIM proves that a domain signed the message, but a different domain can sign a message claiming any From address. DMARC adds the alignment requirement that ties a passing result to the visible From domain.

Question 21Email Authentication and Domain Protection (SPF, DKIM, DMARC)

An SPF record includes 'redirect=_spf.example.net' and also ends with '-all'. How is the redirect modifier evaluated?

  1. It is used only if no mechanism before it matches the sender Correct answer.
  2. It always overrides the -all qualifier for unmatched senders
  3. It is ignored whenever a qualifier is present
  4. It is evaluated before any mechanisms in the record

Explanation

The redirect modifier applies only when no mechanism in the record has produced a match. If a mechanism matches, its qualifier determines the result and redirect is not consulted.

Question 22Email Authentication and Domain Protection (SPF, DKIM, DMARC)

A DKIM verifier reports 'body hash did not verify' while the header signature validates. What is the most likely cause?

  1. The message body was modified in transit after signing Correct answer.
  2. The public key was published with a short TTL
  3. The signing domain does not match the From domain
  4. The selector in the DNS record is missing

Explanation

A body hash mismatch means the canonicalized body no longer matches the bh value computed at signing time, which indicates modification in transit. Header signature validity is a separate check.

Question 23Email Authentication and Domain Protection (SPF, DKIM, DMARC)

A domain publishes 'v=spf1 include:a.example include:b.example include:c.example include:d.example include:e.example include:f.example include:g.example include:h.example include:i.example include:j.example -all'. What risk does this create?

  1. The record may exceed the ten-lookup limit once nested includes are counted, causing permerror Correct answer.
  2. The record will always return softfail because includes cannot be combined
  3. The record disables DKIM signing for the domain
  4. The record prevents DMARC alignment from being evaluated

Explanation

Each include counts as a DNS-querying term, and nested includes inside the referenced policies add further lookups toward the ten-term limit. Exceeding the limit yields permerror, which can break legitimate delivery.

Question 24Email Authentication and Domain Protection (SPF, DKIM, DMARC)

A DMARC record uses adkim=s and aspf=s. How does strict alignment differ from relaxed alignment?

  1. Strict allows subdomain matches while relaxed requires exact matches
  2. Strict applies only to DKIM while relaxed applies only to SPF
  3. Strict requires both SPF and DKIM to pass simultaneously
  4. Strict requires an exact domain match with the From domain, while relaxed allows organizational domain matching Correct answer.

Explanation

Strict alignment demands that the authenticated domain exactly equal the From header domain. Relaxed alignment permits a match at the organizational domain level, so subdomains can align.

Question 25Email Authentication and Domain Protection (SPF, DKIM, DMARC)

After moving to p=reject, an organization notices legitimate newsletters failing DMARC. Which investigation is most appropriate first?

  1. Check whether the newsletter vendor's sending domain aligns with the From domain under the configured alignment mode Correct answer.
  2. Immediately revert to p=none permanently
  3. Disable DKIM verification at the gateway
  4. Remove the rua tag to stop aggregate reports

Explanation

Legitimate failures under enforcement usually stem from misalignment between the authenticated domain and the visible From domain. Reviewing aggregate reports and the vendor's alignment configuration identifies whether SPF or DKIM alignment is missing.

Question 26Email Authentication and Domain Protection (SPF, DKIM, DMARC)

In a DKIM-Signature header, which tag identifies the domain that published the public key used for verification?

  1. s=
  2. d= Correct answer.
  3. b=
  4. h=

Explanation

The d= tag contains the signing domain, and the verifier uses it together with the selector in s= to construct the DNS name where the public key is published. The h= tag lists signed header fields, and b= carries the signature itself.

Question 27Email Authentication and Domain Protection (SPF, DKIM, DMARC)

A DMARC policy of p=quarantine instructs a receiving mailbox provider to take which action on a message that fails DMARC alignment?

  1. Deliver the message normally but add an Authentication-Results header.
  2. Treat the message with suspicion, typically by placing it in the spam folder. Correct answer.
  3. Forward the message to the address in the ruf tag for forensic analysis.
  4. Reject the message during the SMTP transaction with a 5xx reply.

Explanation

Quarantine asks receivers to apply some form of increased scrutiny rather than outright rejection, and in practice this usually means spam-foldering the message. Rejection with a 5xx reply corresponds to p=reject, while ruf reporting is a separate optional function.

Question 28Email Authentication and Domain Protection (SPF, DKIM, DMARC)

Which SPF qualifier indicates that a matching IP address is explicitly not authorized to send mail for the domain?

  1. - Correct answer.
  2. ?
  3. ~
  4. +

Explanation

The minus qualifier produces a fail result, which is the strongest statement that the IP is not authorized. The plus qualifier produces pass, the tilde qualifier produces softfail, and the question mark produces neutral.

Question 29Email Authentication and Domain Protection (SPF, DKIM, DMARC)

A domain's SPF record is 'v=spf1 ip4:192.0.2.0/24 include:_spf.example.net -all'. A message arrives from 192.0.2.55, and the included domain's policy does not match that IP. What SPF result should the receiver produce?

  1. fail Correct answer.
  2. neutral
  3. softfail
  4. pass

Explanation

The ip4 mechanism matches 192.0.2.55 within the /24, so the mechanism evaluates to a match and the qualifier on that mechanism is the default plus, yielding pass. The include is never consulted because evaluation stops at the first matching mechanism.

Question 30Email Authentication and Domain Protection (SPF, DKIM, DMARC)

Why does a DKIM signature cover the From header field in its h= tag?

  1. To satisfy the SPF requirement that the envelope sender match the header From.
  2. To bind the signing domain to the visible author address so that changes to From invalidate the signature. Correct answer.
  3. To allow the verifier to locate the public key through the From domain.
  4. To ensure the message body hash is computed over the From header as well.

Explanation

Including From in h= means the signed hash covers the visible author address, so an attacker cannot alter it without breaking the signature. This binding is what allows DMARC to compare the DKIM d= domain against the From domain for alignment.

Question 31Email Authentication and Domain Protection (SPF, DKIM, DMARC)

A domain publishes 'v=spf1 include:_spf.a.example include:_spf.b.example ~all'. The included policy for _spf.a.example itself ends in '-all'. How should a receiver treat a message from an IP that matches _spf.a.example?

  1. Return pass because a match inside an include yields pass for the including domain. Correct answer.
  2. Return permerror because nested includes are not permitted.
  3. Return fail because the included policy's -all propagates to the top-level record.
  4. Return softfail because the top-level record ends in ~all.

Explanation

When an include mechanism's target domain returns pass, the include mechanism itself matches and evaluation of the including record stops with pass. The included record's own -all applies only within that included evaluation and does not override the outer result.

Question 32Email Authentication and Domain Protection (SPF, DKIM, DMARC)

A DMARC record contains 'rua=mailto:[email protected]!10m'. What does the '!10m' suffix request?

  1. That aggregate reports be sent at most once every ten minutes. Correct answer.
  2. That the receiver retain raw message samples for ten months.
  3. That the reporting address accept reports only for ten minutes after the message is received.
  4. That the receiver send aggregate reports no more frequently than every ten minutes.

Explanation

The optional exclamation-mark suffix on a rua URI sets the maximum reporting interval the domain is willing to accept. A value of 10m asks receivers to batch aggregate reports so they are sent no more often than every ten minutes.

Question 33Email Authentication and Domain Protection (SPF, DKIM, DMARC)

A message passes SPF with an authenticated identifier of bounce.example.net, but the visible From domain is example.com. Under a DMARC record with the default relaxed alignment, what is the DMARC outcome?

  1. Pass, because relaxed alignment ignores the domain entirely.
  2. Fail, because the SPF domain does not align with the From domain. Correct answer.
  3. Fail, because DMARC requires DKIM to pass whenever SPF passes.
  4. Pass, because SPF authenticated the envelope sender.

Explanation

Relaxed alignment still requires the organizational domains of the authenticated SPF identifier and the From domain to match. bounce.example.net and example.com are different organizational domains, so the SPF path does not provide alignment.

Question 34Email Authentication and Domain Protection (SPF, DKIM, DMARC)

A DKIM verifier finds that the header signature validates but the body hash does not. Which condition best explains this result?

  1. The message was modified in transit after signing. Correct answer.
  2. The selector record was not found in DNS.
  3. The signing domain does not match the From domain.
  4. The signature uses an algorithm the verifier does not support.

Explanation

The body hash is computed over the canonicalized body, so a mismatch means the body changed after signing, whether through a mailing list, a gateway, or tampering. The header signature can still validate because the signed header fields were not altered.

Question 35Email Authentication and Domain Protection (SPF, DKIM, DMARC)

Which SPF mechanism causes a DNS lookup that counts against the ten-lookup limit?

  1. exists Correct answer.
  2. all
  3. ip6
  4. ip4

Explanation

The exists mechanism performs a DNS query for an A record at a constructed name, so each use counts toward the lookup limit. The ip4, ip6, and all mechanisms are evaluated locally and do not consume DNS lookups.

Question 36Email Authentication and Domain Protection (SPF, DKIM, DMARC)

An organization wants its main domain to remain at p=none while all subdomains are rejected unless they publish their own DMARC policy. Which record achieves this?

  1. v=DMARC1; p=reject; sp=none
  2. v=DMARC1; p=none; sp=reject Correct answer.
  3. v=DMARC1; p=none; pct=100
  4. v=DMARC1; p=none; adkim=r

Explanation

The sp tag sets the policy applied to subdomains that do not have their own DMARC record, while p applies to the domain publishing the record. Setting p=none with sp=reject keeps the organizational domain in monitoring mode while rejecting unmanaged subdomains.

Question 37Email Authentication and Domain Protection (SPF, DKIM, DMARC)

A message carries two DKIM-Signature headers, and the verifier reports that one signature passes while the other fails. How should this be interpreted for DMARC?

  1. The message passes DMARC only if both signatures share the same selector.
  2. The message can pass DMARC if the passing signature has a d= domain aligned with the From domain. Correct answer.
  3. The message fails DMARC because multiple signatures are not permitted.
  4. The message fails DMARC because any failing signature invalidates the pass.

Explanation

DMARC evaluates each DKIM signature independently and passes if at least one valid signature has a d= domain aligned with the From domain. A failing additional signature does not negate an aligned passing signature.

Question 38Email Authentication and Domain Protection (SPF, DKIM, DMARC)

A domain owner wants to detect spoofing of a subdomain that has no DMARC record of its own, using the organizational domain's policy. Which DMARC tag controls this inheritance?

  1. fo
  2. np Correct answer.
  3. p
  4. sp

Explanation

The np tag sets the policy for non-existent subdomains, that is, subdomains of the organizational domain that have no DNS records at all. The sp tag handles existing subdomains without their own policy, and p handles the publishing domain.

Question 39Email Authentication and Domain Protection (SPF, DKIM, DMARC)

A DKIM signature includes 'l=1000' in its tags. What risk does this introduce?

  1. Content appended after the first 1000 bytes of the body is not covered by the signature. Correct answer.
  2. The signature covers only the first 1000 header fields.
  3. The verifier must reject the message if the body exceeds 1000 bytes.
  4. The public key is valid for only 1000 seconds after signing.

Explanation

The l= tag limits the body hash to a specified number of bytes, so anything appended beyond that length is outside the signed content. Attackers can exploit this to add content to a legitimately signed message without breaking the signature.

Question 40Email Authentication and Domain Protection (SPF, DKIM, DMARC)

A domain publishes 'v=spf1 mx -all'. A sending host's IP matches an MX record but the host has no authorization to send mail. What does SPF conclude, and why is this a design weakness?

  1. Softfail, because the mx mechanism always carries a tilde qualifier.
  2. Pass, because the mx mechanism authorizes any IP appearing in an MX record regardless of role. Correct answer.
  3. Fail, because the host is not listed in an ip4 mechanism.
  4. Permerror, because the mx mechanism cannot be combined with -all.

Explanation

The mx mechanism matches when the client IP appears among the domain's MX records, and a match yields pass, so inbound mail servers are implicitly authorized to send. This can authorize hosts that were never intended as senders, which is why explicit ip4 or include mechanisms are often preferred.

Question 41Cloud Email Platform Architecture and Configuration

In a cloud email platform, which DNS record type is used to publish a domain's SPF policy?

  1. MX
  2. CNAME
  3. TXT Correct answer.
  4. SRV

Explanation

SPF policies are published as a TXT record on the domain (or subdomain) and begin with the v=spf1 version tag. Receivers look up this TXT record to determine which sending hosts are authorized for the envelope sender domain.

Question 42Cloud Email Platform Architecture and Configuration

A domain publishes the policy v=DMARC1; p=none; rua=mailto:[email protected]. What does this configuration actually enforce?

  1. It requests aggregate reports but applies no delivery action to failing mail Correct answer.
  2. It rejects mail that fails SPF alignment but not DKIM alignment
  3. It rewrites the From header to the organizational domain
  4. It quarantines all messages that fail alignment

Explanation

The p=none tag places the domain in monitoring mode: receivers still evaluate SPF and DKIM alignment but take no action on failures. The rua address collects aggregate XML reports so the domain owner can observe authentication results before tightening policy.

Question 43Cloud Email Platform Architecture and Configuration

Which DKIM key length is widely recommended today for newly generated signing keys?

  1. 2048-bit RSA Correct answer.
  2. 4096-bit RSA
  3. 1024-bit RSA
  4. 512-bit RSA

Explanation

2048-bit RSA is the common baseline for new DKIM keys because it balances cryptographic strength against DNS record size and signing cost. 1024-bit keys are considered too weak for new deployments, and 4096-bit keys commonly exceed practical DNS UDP response limits.

Question 44Cloud Email Platform Architecture and Configuration

What is the primary purpose of a cloud email platform's inbound SMTP gateway tier?

  1. To store end-user mailboxes on shared disk
  2. To accept, filter, and route inbound SMTP sessions before delivery to mailbox stores Correct answer.
  3. To host the DNS zone for customer domains
  4. To sign outbound messages with DKIM keys

Explanation

Inbound gateways terminate external SMTP connections, apply connection and content filtering, and then route accepted messages toward the appropriate mailbox backend. Separating this tier lets the platform absorb abusive traffic without exposing storage systems directly to the internet.

Question 45Cloud Email Platform Architecture and Configuration

Which mechanism allows a sending platform to authorize a third-party provider to send on behalf of its domain without sharing DKIM private keys?

  1. An MX record pointing at the provider
  2. A CNAME delegation of the selector to the provider Correct answer.
  3. SPF include with the provider's domain
  4. A global DNS wildcard for the domain

Explanation

Delegating a DKIM selector via CNAME lets the provider publish and rotate its own public key under the customer's domain namespace. The customer never handles the private key, and the provider can rotate keys without customer DNS changes.

Question 46Cloud Email Platform Architecture and Configuration

A tenant mailbox is configured with a forwarding rule to an external address while the platform also retains a copy locally. Which configuration must be reviewed to avoid breaking SPF alignment at the destination?

  1. The DMARC ruf address
  2. The DKIM selector name
  3. The MX preference values
  4. The SRS or forwarding rewrite settings Correct answer.

Explanation

When mail is forwarded, the envelope sender may change to the forwarding host, breaking SPF alignment at the final destination. Sender Rewriting Scheme or equivalent forwarding controls preserve deliverability by rewriting the envelope sender while keeping the original domain information.

Question 47Cloud Email Platform Architecture and Configuration

Which record must exist for a DKIM selector named sel1 on domain example.com?

  1. sel1._domainkey.example.com Correct answer.
  2. _domainkey.sel1.example.com
  3. sel1.dkim.example.com
  4. dkim.sel1.example.com

Explanation

DKIM public keys are published at selector._domainkey.<domain>, so selector sel1 on example.com resolves at sel1._domainkey.example.com. The verifier constructs this name from the d= and s= tags in the signature.

Question 48Cloud Email Platform Architecture and Configuration

What does a DMARC alignment mode of relaxed require for the From domain?

  1. An exact string match between the From domain and the authenticated domain
  2. That the message be signed with a 2048-bit key
  3. That both SPF and DKIM pass simultaneously
  4. A match on the organizational domain rather than the full subdomain Correct answer.

Explanation

Relaxed alignment accepts a match at the organizational domain level, so mail from a subdomain aligns with an authenticated parent domain. Strict alignment, by contrast, requires the domains to match exactly.

Question 49Cloud Email Platform Architecture and Configuration

A cloud platform tenant wants inbound mail for a subdomain routed to a separate mailbox environment. Which DNS change accomplishes this?

  1. Add a TXT record for the subdomain
  2. Add a CNAME for the subdomain apex to the primary domain
  3. Publish an SPF record without the subdomain
  4. Create MX records for the subdomain pointing to the alternate environment Correct answer.

Explanation

Inbound routing is controlled by MX records, so pointing the subdomain's MX at the alternate environment sends its mail there. TXT and SPF records affect authentication, not delivery destination.

Question 50Cloud Email Platform Architecture and Configuration

An administrator needs to enforce TLS for inbound SMTP on a gateway tier. Which control most directly accomplishes that?

  1. Enabling DKIM signing on outbound
  2. Requiring STARTTLS and rejecting sessions that do not negotiate it Correct answer.
  3. Adding an SPF hard fail
  4. Publishing a DMARC reject policy

Explanation

Transport security is enforced at the SMTP session layer by requiring STARTTLS (or implicit TLS on port 465) and refusing plaintext sessions. DMARC, DKIM, and SPF operate on message authentication and have no effect on transport encryption.