Having Received a Targeted Attack from a Spoofed Email Domain

Multiple Choice

Having received a targeted attack from a spoofed email domain, a company wants to take advantage of DKIM validation for inbound mail. The messaging administrator has enabled sender authentication and DKIM validation and now needs to configure a content filtering policy to quarantine any messages that fail. Which condition should be met for the content filtering policy to fire?

A) The envelope sender email address contains "dkim=fail".
B) The message header contains "dkim=fail".
C) The file metadata MIME type is "dkim=fail".
D) The text in the subject, body, or attachments contains "dkim=fail".