Forum Moderators: phranque
Received: from probablyfakehost (host.example.com [nnn.nnn.nnn.nnn])
by mx.yourmailhost.com (Postfix) with ESMTP id zzzzzzzzz for <you@yourdomain.com>; Tue, 15 Nov 2005 08:51:12 +HH00 (timezone)
Bolding added for emphasis.
probablyfakehost is usually spoofed
host.example.com is sometimes accurate as that is your mailserver doing a reverse lookup on the IP.
But the most accurate is for you to take nnn.nnn.nnn.nnn and do a DNS lookup on it to find out what the ISP is.