А что подозрительного?

phx.gbl is an internal Active Directory domain that Microsoft uses to manage datacenter machines. It gets added to message headers as a way to trace what machines actually saw a message when Microsoft needs to diagnose specific problems. The name is equivalent to a *.local domain some organizations use for AD management. It is by design that these machines are not addressable from the internet as part of Microsoft's defense in depth security planning.