ECIH email incident response guidance emphasizes email header analysis as the primary validation technique for suspected spoofing or impersonation attacks.

Option A is correct because headers reveal sender IPs, routing paths, and authentication results (SPF, DKIM, DMARC). This evidence directly confirms whether the email originated from a legitimate source.

Options B, C, and D are supplementary actions but do not provide authoritative validation.