How to read headers for Cisco Email Security?

[rkazi]

Hello, 

We just deployed Cisco Email Security in our environment. I am having trouble reading/understanding the headers as the headers are totally different than how they used to be. 

I am interested in knowing the originating IP. while checking the headers I see X-IronPort-RemoteIP: 212.94.64.25 at the very top.

Is that the originating IP? or the one which shows just above the TO: field as shown below

Received: from planet11.businessweb.fi (HELO planet11.iwn.fi)([ 212.94.65.226]) by ironport2.imageworld.fi with ESMTP; 26 Jul 2017 15:38:06 +0300

Thanks 

[Libin Varghese]

Hi

The X-IronPort-RemoteIP should ideally contain the originating IP, you can confirm this by comparing the IP to the sender IP seen is the message tracking details for the emails.

You can also use the analyze headers option on mxtoolbox.com to help with reading headers.

- Libin V