Question

The ezmlm program was the first to use a technique where this field is modified per individual, called VERP. In one protocol, this field is checked for either “strict” or “relaxed” alignment, after which a user-defined policy specifies one of the actions “none”, “quarantine”, or “reject”. This field is commonly wrapped by adding a hash, timestamp, and the prefix “SRS” in a namesake “Rewriting Scheme”. A “signing domain” specified in the “d=” (“d equals”) tag is consulted over DNS to check that this field is signed correctly in the (*) DKIM (“DEE-kim”) protocol. The DMARC (“DEE-mark”) protocol extends a protocol for verifying this field called SPF, or “[this word] Policy Framework”. (10[1])This field (10[1])is also called the reverse path or return path in an (10[1])SMTP envelope, and is where bounce (10[1])messages are sent. For 10 points, phishers attempt to forge what field when spoofing an email? ■END■ (10[1])

ANSWER: email sender [accept FROM address; prompt on “email address” with “what field containing the email address?”; accept envelope sender; accept reverse path or return path or return address before mentioned] (Technically, the FROM address and the envelope sender are not exactly the same thing, but I didn’t think it was worth raising the distinction in the question.)
<AW>
= Average correct buzz position

Back to tossups