There is a recent rise in Spam mails sent from seemingly legit german email-addresses according to the mail headers:

Received: from mx1.aok.de ([])

But when I nslookup mx1.aok.de, I get another addresss:

Name:    mx1.aok.de

When I reverse lookup, I get mngw.ungstabled.com which won't budge since the domain seems to have an spf record and my email provider should check it.

My question is how spam actors managed to spoof the reverse lookup of the domain or if I missunderstood any of the concepts involved?

There are several other seemingly compromised domains constantly sending spam about bitcoin.

1 Answer 1


There is no DNS spoofing involved. The name given in the Received header is the name claimed by the sending MTA in the EHLO command during the SMTP dialog. From RFC 5321 section 4.4:

4.4. Trace Information

... insert trace ("time stamp" or "Received")
information at the beginning of the message content ... This line MUST be structured as follows:

o The FROM clause, which MUST be supplied in an SMTP environment, SHOULD contain both (1) the name of the source host as presented in the EHLO command and (2) an address literal containing the IP address of the source, determined from the TCP connection.

  • But the IP address involved should be from the actual sender right? So my mail provider seemingly failed to verify if the sending IP address is indeed mentioned in the spf record of the given domain?
    – user77029
    Dec 4, 2020 at 10:38
  • @user77029: First, SPF is optional. Second, SPF is usually not used to actually block mail. A policy regarding blocking does not exist at the level of SPF, only at the level of DMARC which uses the result from SPF. If SPF is checked might be visible from Authentication-Results or Received-SPF header. Dec 4, 2020 at 11:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .