I've just received some spam/phishing with a fake toolserver.org from:
Received: from [91.183.97.229] (port=48489 helo=229.97-183-91.adsl-static.isp.belgacom.be) by toolserver.org with esmtp (Exim 4.82) (envelope-from <nemobis@toolserver.org>) id 1ano4X-0000WJ-Ie for nemobis@toolserver.org; Wed, 06 Apr 2016 14:04:42 +0000 From: <nemobis@toolserver.org> To: <nemobis@toolserver.org> Subject: Document(1) Thread-Topic: Document(1) Thread-Index: AdF+sJZYKtxaTvOhSFC+rMKD/CUwyg== Date: Wed, 06 Apr 2016 16:04:35 +0200 Message-ID: <0B8EBA2C013EB0EB02C5073C7EB86AF16E5F4FE@BORO-SBS.boro.local>
I doubt there is any legitimate sender of mails with a toolserver.org from, hence better stop all fraud with a restrictive SPF ("mx -all" or similar).