Is this a phishing or legit email

[moomins]

Hi, is this a phishing email? It doesn't address me by name, so I'm assuming it is. Normally I'd simple ignore and delete an email like this because it doesn't include my name, but yesterday a friend told me emails sent to a different address on the same domain are bouncing back to him as spam. So it seems odd that this email shows up hours later, although it could just be a coincidence. 

If it helps, the raw source (with the email removed) is below, which appears to say the email came from an aol account... so IDK...

Thanks for any thoughts on this.

Received: (qmail 126506 invoked by uid 30297); 22 Oct 2019 11:03:18 -0000

Received: from unknown (HELO p3plibsmtp03-11.prod.phx3.secureserver.net) ([68.178.213.106])

          (envelope-sender <sync@aol.com>)

          by p3plsmtp25-05-26.prod.phx3.secureserver.net (qmail-1.03) with SMTP

          for <REDACTED>; 22 Oct 2019 11:03:18 -0000

Received: from aol.com ([103.68.164.225])

by CMGW with ESMTP

id Mrwai0ncW4wVlMrwbiWEfo; Tue, 22 Oct 2019 04:03:18 -0700

X-IP-SPAM: Suspect

From: Godaddy Webmail Security <Security Alerts@Godaddy.com>

To: REDACTED

Subject: Spam detected from email account REDACTED

Date: 22 Oct 2019 19:03:16 +0800

Message-ID: <20191022180906.ED7B3E4EB346F668@Godaddy.com>

MIME-Version: 1.0

Content-Type: text/html;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-CMAE-Envelope: MS4wfKzA1SDlsGkKqFMw7zTa34DFzPDFsWkiuJhCBGquCCW7h3gDlQ3PGb4Bpoopgn5oi1J5adI3YE5ALn2vJAgRj7sdh1okoG5XUe1SCfF0U7GdgOe+zc75

5qd76ELOHcSEXDN17uXGnqcoojC/BxBDny9iPW8J7uwtiRzDLkRmlgql

X-Nonspam: None

[Nate · Accepted solution]

Yes, this does look phishy.  You can report it at https://supportcenter.godaddy.com/AbuseReport

What service are you using for email on your domain?

[moomins]

Thanks Nate, yeah I figured it looked a bit phishy too, reported it. I'm still using GoDaddy Workspace for email, been with GD a long time and never got around to upgrading or moving it to something newer, if it ain't broke, etc...

[Nate]

I'll urge you to consider one of the modern platforms like Office 365 or G Suite to get the latest features including productivity and security.

Make sure you have an SPF record on the domain which helps prevent email spoofing.

https://www.godaddy.com/help/what-is-an-spf-record-24605

https://www.godaddy.com/help/add-an-spf-record-19218

It looks like this should be the appropriate record.

---

https://www.godaddy.com/community/Managing-Email/What-are-the-correct-GoDaddy-SPF-Settings-For-DNS-t...

v=spf1 include:secureserver.net –all

---