How can I tell if this was sent from our pop3, or if it just spoofed our email address? I received a suspicious looking email, so I clicked on it and chose "Message Options", then "Internet Headers". Does this tell you whether the email came from us?
Received: from CONTUSO3 (127.0.0.1) by CONTUSO3.contuso.local
(127.0.0.1) with Microsoft SMTP Server id 8.1.436.0; Thu, 18 Aug 2016
03:08:22 -0500
Received: by [CONTUSO3.contuso.local (Microsoft Connector for POP3
Mailboxes)] id <"{732EC142-7413-40A4-8D66
-40E2F5000
B9F}"@cont
uso.local>
;
Thu, 18 Aug 2016 03:08:12 -0500
Resent-Sender: <pop3connector@contuso.loc
al>
Received: from spamappliance.filterservic
e.net ([206.220.200.250]) by
mail.filterservice.net (filterservice.net Mail Server) with SMTP id GQW32710 for
<joe@contuso.com>; Thu, 18 Aug 2016 01:04:10 -0700
Received: from o2.email.goodrx.com ([167.89.56.103]) by
spamappliance.filterservic
e.net ({b4b26338-9a18-4b5f-aa5a-
88d68e664c
57}) via
TCP (inbound) with ESMTPS id 20160818080401290_0000 for
<joe@contuso.com>; Thu, 18 Aug 2016 08:04:01 +0000
X-RC-FROM: <bounces+826630-03ee-joe=c
ontuso.com
@email.goo
drx.com>
X-RC-RCPT: <joe@contuso.com>
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=email.goodrx.com;
h=content-type:from:mime-v
ersion:sub
ject:to:li
st-unsubsc
ribe;
s=smtpapi; bh=nI0ETc4siUeeqE0aW6ByUW4
XW+o=; b=N3patISXSK3cOYj5p4
/QRPSP+EXm1T6EC7mqTMUiMhCV
kYX6o9/PWZ
jninTXnTeN
+joqDP6Tna
rZAo26io
hbRzURcYknX5HTNZ4xUtx0u7Fd
gYKaOMGzHB
8m9K9hshIz
98HhCMY0JE
0q/ChBv2
v8qP2ON1lwIfhyPrXC0DoLUAE=
Received: by filter0196p1las1.sendgrid.
net with SMTP id
filter0196p1las1.6001.57B5
6BEB14 2016-08-18 08:03:55.481860943 +0000
UTC
Received: from ODI2NjMw (ec2-204-236-149-232.us-we
st-1.compu
te.amazona
ws.com
[204.236.149.232]) by ismtpd0012p1las1.sendgrid.
net (SG) with HTTP id
z6Fo25xKSE6khE_UgRnBsA for <joe@contuso.com>; Thu, 18 Aug 2016
08:03:55.485 +0000 (UTC)
Content-Type: multipart/alternative;
boundary="2a0f4bf16df38ca3
34295a378b
6f9d8bad77
6c1ec847cf
9de6c38434
c1c4"
Date: Thu, 18 Aug 2016 08:03:55 +0000
From: GoodRx <no-reply@goodrx.com>
MIME-Version: 1.0
Subject: GoodRx - Your My Rx account is set up!
To: joe@contuso.com
Message-ID: <z6Fo25xKSE6khE_UgRnBsA@is
mtpd0012p1
las1.sendg
rid.net>
X-SG-EID: FS+2Csyt4B3n1VYAYljlhEsaD3
WbVuLN4l24
TDbAQo0GOP
WxUD5Smxde
8YRKb738eL
K1Sh/dW9Cg
MN
s+GXH7UeQq23NALueVOAB/fhJI
rUXEZJ9zec
VPi+gQsL/b
NDR+rISOZa
KutqWOQ/wh
oNmiN6aqY6
W0
15/xsZ81oeazn99y139OKOuEGL
c/hWszjoZp
Shh/Bacsq6
ugAVR2Lxup
HQ==
X-SG-ID: lBO1GoPdSkYXCKIlFaV4t2paGB
1f9MgO+qgY
EqU7DuDHvF
Wy8uCnMTYb
DjkSnKk94X
meMx+DtUtB
TO
K+MMUxJWruI7mISPviPSALcnIv
Kq0=
List-Unsubscribe: <
http://email.goodrx.com/wf/unsubscribe?upn=5EkAOyONdohov9wua-2ByXWZKFHZErHyck-2Fabbq6t49m-2FGXHCadd5JUVXD11gAKnNXRIhOPFjMUnGj3iX7s4ODl1v-2FmMoEHHniSQyZyyQR0ZV0xtB7RdRdh9pOXaNVZJfzu7eqBIWcEQHN8u0C8gzLuN6L8XHPqYdQGxWRcH-2FyLfVzgwJh7M-2FdwJepmesuJFdeqtvv8pdF-2F-2FhrWSycpSsOf7ZU7mDRvVub-2BW8xR5jW6stjboEakN3GbKyIsm0r9dhaLSqR2HlMWigeN6xEBzLVkG30siJRvGTrlznYWCpGadGwUB-2FLUdAIfgIr-2Bx3dE67Y>, <mailto:unsubscribe@email.
goodrx.com
?subject=
http://email.goodrx.com/wf/unsubscribe*q*upn=5EkAOyONdohov9wua-2ByXWZKFHZErHyck-2Fabbq6t49m-2FGXHCadd5JUVXD11gAKnNXRIhOPFjMUnGj3iX7s4ODl1v-2FmMoEHHniSQyZyyQR0ZV0xtB7RdRdh9pOXaNVZJfzu7eqBIWcEQHN8u0C8gzLuN6L8XHPqYdQGxWRcH-2FyLfVzgwJh7M-2FdwJepmesuJFdeqtvv8pdF-2F-2FhrWSycpSsOf7ZU7mDRvVub-2BW8xR5jW6stjboEakN3GbKyIsm0r9dhaLSqR2HlMWigeN6xEBzLVkG30siJRvGTrlznYWCpGadGwUB-2FLUdAIfgIr-2Bx3dE67Y>
Return-Path: no-reply@goodrx.com
X-MS-Exchange-Organization
-PRD: contuso.local
X-MS-Exchange-Organization
-SenderIdR
esult: None
Received-SPF: None (CONTUSO3.contuso.local:
pop3connector@contuso.loca
l does not designate permitted sender hosts)
X-MS-Exchange-Organization
-SCL: 6
X-MS-Exchange-Organization
-PCL: 2
X-MS-Exchange-Organization
-Antispam-
Report:
DV:3.3.5705.600;SID:Sender
IDStatus None;OrigIP:206.220.200.25
0
Sendgrid.net is a big source of spam and fraud. I got "bank" alerts from them.
Delete them - do NOT open.