And while I'm at it, how can he tell when an email is sent from the domain he's watching? That wouldn't be possible just from being able to see DNS traffic, wou

And while I'm at it, how can he tell when an email is sent from the domain he's watching? That wouldn't be possible just from being able to see DNS traffic, would it?