We are a little company with our own domain (e.g. ddd.com). We have our own mail server. By our provider (sss.com) we have one mx record: 10 mail.ddd.com and one mx record with provider`s domain name: 50 mail1.sss.com. If someone sends me a mail, it is directed to my mail server mail.ddd.com. If it is not accessible, mail is sent to mail1.sss.com. This mail is later delivered from this server to our mail server mail.ddd.com. My question: what IP address do I see it was sent from. Is it an original IP address, or is it a address of mail1.sss.com mail server. I ask because of we are going to implement a new antispam machine with IP repotations mechanizm on our gateway. I want to know, if spams going from mail1.sss.com can be processed by IP reputation.
My question: what IP address do I see it was sent from. Is it an original IP address, or is it a address of mail1.sss.com mail server.
The "Received" headers always include a full received path.
Any mail server that touches your email will show up in the Received headers.
So in the headers, you'd see the IP of the sending mail server, followed by the IP of any mail server along the way that touches the mail, even if it's a backup server.
For your spam program -- you could always configure it to ignore the IP of your backup mail server, and to instead look at the IP of the server it received the email from.
-Eric