certified: > gives: Received: from www.first.com (unknown [nnn.nnn.nnn.nnn]) regardless > if sent by first or second.
The RECEIVED line contains Postfix myhostname value, not the email address. And you should have proper DNS so that www.first.com resolves to the IP address, and the IP address resolves to www.first.com. This is often part of a spam check. The "-f u...@example.com" specifies among others the Return-Path address, as well as the from= address in Postfix logs. This is also the address in the MAIL FROM command in the SMTP protocol, which is what remote hosts use for early spam blocks. Wietse