Your firewall is probably a proxying firewall that acts as your domains MX, in which case, it would always look like it came from the firewall....which is why I suggested you talk to your firewall admin...

/nebulus