Which statement correctly describes SPF's function in email authentication?

• A. SPF validates the recipient's mailbox using domain reputation.
• B. SPF signs messages with a cryptographic key.
• C. SPF validates the sending host by checking its IP address against the domain's SPF record.
• D. SPF blocks attachments using content filtering.

Answer: (C)

SPF works by allowing domain owners to publish a DNS SPF record that lists which sending hosts are authorized to mail for that domain. When a message arrives, the receiving server queries the domain’s SPF TXT record and compares the sending server’s IP address to the authorized list. If the IP matches, the SPF check passes, indicating the mail is coming from an allowed source; if not, it fails or softfails, helping to detect spoofing. This is different from signing messages (that would be DKIM) or blocking attachments via content filters. SPF focuses on verifying the sending host by IP against the domain’s published policy, not on the recipient’s mailbox reputation.