sender mailserver found on blacklist server

I'm using exchange server 2003 + GFI mailessentials 12 for spam filtering.

One of our business client is trying to send us an email which is filtered by GFI as the Sending mail server found on The problem is when I do MX Query to senders domain I get single IP 195.X.X.X which I checked in all blacklist servers, but its clean. but the problem is when I check the email header I see another IP address 81.X.X.X which when I query in blacklist server it is listed in lot of servers. the sender is not a spammer, and his emails gets blocked by our GFI. I also can add him in whitelist but I want to know the reason what really is the problem, as I have seen this with other clients as well.

[Header's keywords]

Our Exchange server domain is:  (just for demonstration)  
sender's domain is:
sender name is: senderusername
Sender's IP: 195.X.X.X
another IP in headers: 81.X.X.X ( dont know where it came from, could be the Outlook's Machine IP? )

Kindly advise me on this situation, what is going on/wrong and what should I do to handle these problems in future.

Thanks a lot.

[Full Headers]

Microsoft Mail Internet Headers Version 2.0
Received: from ([195.X.X.X]) by with Microsoft SMTPSVC(6.0.3790.3959);
       Thu, 30 Oct 2008 13:11:17 +0000
Received: from [81.X.X.X] (port=3138 helo=senderusername)
      by with esmtpa (Exim 4.69)
      (envelope-from <>)
      id 1KvVKZ-0006nB-RR; Thu, 30 Oct 2008 11:04:51 +0000
From: "Sender Full Name" <>
To: "''" <>
Cc: <>
References: <>
Subject: RE: - Sending mail server found on - RE: Mortgage Offer
Date: Thu, 30 Oct 2008 13:10:14 -0000
Message-ID: <91C2A5BA7A4345258FED891BC307D322@senderusername>
MIME-Version: 1.0
Content-Type: multipart/mixed;
X-Mailer: Microsoft Office Outlook 11
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5579
Thread-Index: Ack1v+PT2kiCzQdaS5qneC953FN6lgAAFNEgANL9GqAAAHpeIABdTXAQAAAhgyAAADfG0AAC/oKw
In-Reply-To: <>
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname -
X-AntiAbuse: Original Domain -
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain -
X-OriginalArrivalTime: 30 Oct 2008 13:11:17.0833 (UTC) FILETIME=[FE9F6390:01C93A90]

Content-Type: multipart/related;

Content-Type: multipart/alternative;

Content-Type: text/plain;
Content-Transfer-Encoding: 7bit

Content-Type: text/html;
Content-Transfer-Encoding: quoted-printable

Content-Type: image/gif;
Content-Transfer-Encoding: base64
Content-ID: <image001.gif@01C93A90.D8683760>

Content-Type: image/gif;
Content-Transfer-Encoding: base64
Content-ID: <image002.gif@01C93A90.D8683760>

Content-Type: image/gif;
Content-Transfer-Encoding: base64
Content-ID: <image003.gif@01C93A90.D8683760>

Content-Type: image/gif;
Content-Transfer-Encoding: base64
Content-ID: <image004.gif@01C93A90.D8683760>

Content-Type: image/gif;
Content-Transfer-Encoding: base64
Content-ID: <image005.gif@01C93A90.D8683760>

Content-Type: application/msword;
      name="abbey acs ref request - ltd co.doc"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
      filename="abbey acs ref request - ltd co.doc"


Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Seems they are relaying their mail via an ISP smtp relay server, from the headers it looks like their IP is on the blacklist and their ISP isn't. Either way they need to apply to the block lists to be removed. It's worth doing a whois on the IP addresses to check who owns them before you whitelist anything.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Hugh FraserConsultantCommented:
The MX record points to the host used to receive mail. Outbound mail can (and in this case does) go through another host, and that's the one that mail recipients check against RBLs.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.