There is a recent rise in Spam mails sent from seemingly legit german email-addresses according to the mail headers:
Received: from mx1.aok.de ([22.214.171.124])
But when I
nslookup mx1.aok.de, I get another addresss:
When I reverse lookup
126.96.36.199, I get
mngw.ungstabled.com which won't budge since the domain seems to have an spf record and my email provider should check it.
My question is how spam actors managed to spoof the reverse lookup of the domain or if I missunderstood any of the concepts involved?
There are several other seemingly compromised domains constantly sending spam about bitcoin.