3

I know that you can use the Received header to determine where an email came from, but what if the Date header contradicts the Received: from header.

You can see below that the email was sent at 04:16:43 -1000.

enter image description here

But looking at the Received: from header (there's only one), we can see that it came from a -0800 (PST) timezone.

enter image description here

So which is correct? -1000 is not the same location as -0800. Can I depend on the date header here?

1
  • 1
    LA (the state of Louisiana) is not -0800. L.A. (the city of Los Angeles) is. And with a name like "Jumbalaya" it's hard to tell which one you actually mean.
    – sawdust
    Jan 5, 2015 at 0:15

2 Answers 2

5

The Date header is usually added by the program composing the message, so the timezone will correspond to that of the author's computer. (This is true even for Gmail.) So assuming the composer isn't lying, the message was written in -1000.

Received headers, however, are added by the mail servers handling that message. Their time stamps are made when the server receives the message and will therefore correspond to the server's location. (That's the only possible option anyway – the server has no way of knowing where the client is!) It's quite possible that Google has a datacenter somewhere in -0800.

2
  • @JumbalayaWanton: Maybe the sender simply didn't update their timezone settings after travelling. Phones tend to do so automatically, but PCs very rarely do. Jan 5, 2015 at 5:35
  • 1
    I have just found out that Google are meanly adding their own Date: header if it is missing. They do both while sending and receiving. Jan 28, 2019 at 10:40
3

You are free to set your computer to whatever timezone you want. If you feel that, though you’re living in L.A., your soul is in Hawaii, you might as well set your computer to display UTC-10h.

There is absolutely no reliable relation between physical location and the timezone set on a PC.

Even worse, the date header could be completely forged. In this case, it isn’t, because the mail arrived at Google a mere 2 seconds later.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .