3

I know that you can use the Received header to determine where an email came from, but what if the Date header contradicts the Received: from header.

You can see below that the email was sent at 04:16:43 -1000.

enter image description here

But looking at the Received: from header (there's only one), we can see that it came from a -0800 (PST) timezone.

enter image description here

So which is correct? -1000 is not the same location as -0800. Can I depend on the date header here?

Community
  • 1
Jumbalaya Wanton
  • 133

2 Answers2

5

The Date header is usually added by the program composing the message, so the timezone will correspond to that of the author's computer. (This is true even for Gmail.) So assuming the composer isn't lying, the message was written in -1000.

Received headers, however, are added by the mail servers handling that message. Their time stamps are made when the server receives the message and will therefore correspond to the server's location. (That's the only possible option anyway – the server has no way of knowing where the client is!) It's quite possible that Google has a datacenter somewhere in -0800.

grawity
  • 501,077
3

You are free to set your computer to whatever timezone you want. If you feel that, though you’re living in L.A., your soul is in Hawaii, you might as well set your computer to display UTC-10h.

There is absolutely no reliable relation between physical location and the timezone set on a PC.

Even worse, the date header could be completely forged. In this case, it isn’t, because the mail arrived at Google a mere 2 seconds later.

user219095
  • 65,551