Where does the UTM document whether it successfully validated SPF records? and with which IP and or Domain it was validated? I have to investigate a phishing campaign and i have access to the email itself as well as the smtp log file. In neither of…

I'm using Google Apps Split Delivery. Mail hits google, and half of it get forwarded to my UTM, then onto my corporate email server. (The other half of the organization will use gmail). If I allow Gmail to do their spam filtering, it tags WAY too much…