Spoofed DNS-Address in Spam mail header

Question

There is a recent rise in Spam mails sent from seemingly legit german email-addresses according to the mail headers:

Received: from mx1.aok.de ([91.199.166.49])

But when I nslookup mx1.aok.de, I get another addresss:

Name:    mx1.aok.de
Address:  217.110.254.8

When I reverse lookup 91.199.166.49, I get mngw.ungstabled.com which won't budge since the domain seems to have an spf record and my email provider should check it.

My question is how spam actors managed to spoof the reverse lookup of the domain or if I missunderstood any of the concepts involved?

There are several other seemingly compromised domains constantly sending spam about bitcoin.

Answer 1

There is no DNS spoofing involved. The name given in the Received header is the name claimed by the sending MTA in the EHLO command during the SMTP dialog. From RFC 5321 section 4.4:

4.4. Trace Information

... insert trace ("time stamp" or "Received")
information at the beginning of the message content ... This line MUST be structured as follows:

o The FROM clause, which MUST be supplied in an SMTP environment, SHOULD contain both (1) the name of the source host as presented in the EHLO command and (2) an address literal containing the IP address of the source, determined from the TCP connection.