这封邮件真的来自 youku.com 么？

[Saaee]

下面是头信息，From 和To 的信息被我修改过了。其他都原样。

Received: from mail2.testo.net.cn (unknown [106.120.71.197])
by newmx96.qq.com (NewMx) with SMTP id
for <[e-mail]>; Sun, 28 Sep 2014 14:57:22 +0800
X-QQ-SSF: 0050000001000020016000010000601
X-QQ-FEAT: qTtZPiCtkTbAuQUTMImxSuqYibT7boz+ivFm/O2nl43cYqe9P5toB0Eld5YBI
nRAIWhbvwztlov4tRDCIhK8wYdPUECNkWkeBFWqb753iGFrWU4LBcL1S7Kd+g+taVAgWWcP
XhJLgad7KJ45h1+11lvIBJnonc0PDkm8R55FfQyF7JZiwqSoX+P2Npm+9cSoVk+wfRWhcGU
5h0+NeNU9Zoih+V/JiChGF2br+ke7mAY=
X-QQ-mid: mx96t1411887444t2z3b8usj
Received: from mail2.testo.net.cn (localhost.localdomain [127.0.0.1])
by localhost (Email Security Appliance) with SMTP id 90262EA4A29_427B151B
for <[e-mail]>; Sun, 28 Sep 2014 06:57:21 +0000 (GMT)
Received: from IT-EXCH-CAS01.1verge.com (unknown [10.10.0.17])
by mail2.testo.net.cn (Sophos Email Appliance) with ESMTP id D6A9CEA421E_427B14AF
for <[e-mail]>; Sun, 28 Sep 2014 06:57:14 +0000 (GMT)
Received: from IT-EXCH-MB06.1verge.com ([fe80::8018:5ab4:3ccc:5177]) by
IT-EXCH-CAS01.1verge.com ([fe80::7932:fe21:bc35:1976%13]) with mapi id
14.02.0247.003; Sun, 28 Sep 2014 14:57:14 +0800
From: xxxxxxxxxxxxxxxxxxxxx
To: "[e-mail]" <[e-mail]>

Thread-Index: Ac/a5iAbCXcqdQQCQQ+J//yGhTmC3w==
Date: Sun, 28 Sep 2014 06:57:14 +0000
Message-ID: <[e-mail]>
Accept-Language: zh-CN, en-US
Content-Language: zh-CN
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
x-originating-ip: [10.10.161.13]
Content-Type: multipart/related;
boundary="_007_970059888831A34CA5F76F005B9B98D0612A11F1ITEXCHMB061verg_";
type="multipart/alternative"
MIME-Version: 1.0

--_007_970059888831A34CA5F76F005B9B98D0612A11F1ITEXCHMB061verg_
Content-Type: multipart/alternative;
boundary="_000_970059888831A34CA5F76F005B9B98D0612A11F1ITEXCHMB061verg_"

--_000_970059888831A34CA5F76F005B9B98D0612A11F1ITEXCHMB061verg_
Content-Type: text/plain; charset="gb2312"
Content-Transfer-Encoding: base64

[msg7086]

只有dkim和spf记录能证明。

[ooxxcc]

[e-mail]

[hzqim]

伪造主机头是很容易的事情。
任意邮件服务器都可以绑定youku.com域名进行发信，管发不管收，因为youku.com不指向它。

[damajia]

spf=pass (sender IP is ××××; identity alignment result is pass and alignment mode is relaxed) smtp.mailfrom=××@××.com; dkim=pass)

这样的才能说明发信者是谁