at 6:50 That ip is from the domain server is not from the sender and it is possible the ip is different from the branch location. At 5:28 you should check SPF Value (Email Header) Cause Recieve IP that you copied is the HUB and that email across. By the way, this is great content thank you for your spaying.