Here is another clue, for their SPF setup: dig txt kwflowers.com ;; ANSWER SECTION: kwflowers.com. 21599 IN TXT "v=spf1 mx:ufn.com include:cmail1.com include:spf.mtasv.net include:amazonses.com -all" This means that someone did setup ufn.com for accepting emails, as well as cmail1.com, spf.mtasv.net and amazonses.com