Exacto, activando las cabeceras o la propiedades avanzadas en un webmail puedes ver esto:
X-Gmail-Received: b9f1f55cf7755a88ee1134560c05a4c0eb139f2c
Delivered-To:
[email protected]
Received: by 10.49.3.4 with SMTP id f4cs52871nfi;
Tue, 21 Mar 2006 20:37:09 -0800 (PST)
Received: by 10.36.67.7 with SMTP id p7mr734294nza;
Tue, 21 Mar 2006 20:37:08 -0800 (PST)
Return-Path: <
[email protected]>
Received: from hotmail.com (bay107-f3.bay107.hotmail.com [64.4.51.13])
by mx.gmail.com with ESMTP id 23si6152570nzn.2006.03.21.20.37.08;
Tue, 21 Mar 2006 20:37:08 -0800 (PST)
Received-SPF: pass (gmail.com: domain of
[email protected] designates 64.4.51.13 as permitted sender)
Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC;
Tue, 21 Mar 2006 20:37:08 -0800
Message-ID: <
[email protected]>
Received: from 64.4.51.220 by by107fd.bay107.hotmail.msn.com with HTTP;
Wed, 22 Mar 2006 04:37:05 GMT
X-Originating-IP: [24.232.250.93]
X-Originating-Email: [
[email protected]]
X-Sender:
[email protected]
From: "jose gonzalez" <
[email protected]>
To:
[email protected]
Bcc:
Subject: este viernes toca deep purple en obras
Date: Wed, 22 Mar 2006 05:37:05 +0100
Mime-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1; format=flowed
X-OriginalArrivalTime: 22 Mar 2006 04:37:08.0020 (UTC) FILETIME=[4707BF40:01C64D6A]
Por supuesto que todo puede ser falseado...excepto el received from, que es justamente la parte que coloca el servidor de correo (con su IP), en este caso jotmail, aunque pueden aparecer otros si el mail pasa por otros servidores "intermedios"
salu2