A bit like this. Server ip and domain it was sent from is found.
Code:
Received: by 10.64.236.40 with SMTP id ur8csp270236iec;
Sat, 16 Aug 2014 22:01:33 -0700 (PDT)
X-Received: by 10.236.129.3 with SMTP id g3mr42503511yhi.67.1408251693456;
Sat, 16 Aug 2014 22:01:33 -0700 (PDT)
Return-Path: <bounce-md_30152195.53f036ff.v1-4a68e3a9c92a4da1abcc77bffb4b1933@mandrillapp.com>
Received: from cloudmail.curse.com (cloudmail.curse.com. [205.201.137.179])
by mx.google.com with ESMTPS id k26si17311804yhh.188.2014.08.16.22.01.33