2

I know that you can use the Received header to determine where an email came from, but what if the Date header contradicts the Received: from header.

You can see below that the email was sent at 04:16:43 -1000.

enter image description here

But looking at the Received: from header (there's only one), we can see that it came from a -0800 (PST) timezone.

enter image description here

So which is correct? -1000 is not the same location as -0800. Can I depend on the date header here?

  • 1
    LA (the state of Louisiana) is not -0800. L.A. (the city of Los Angeles) is. And with a name like "Jumbalaya" it's hard to tell which one you actually mean. – sawdust Jan 5 '15 at 0:15
4

The Date header is usually added by the program composing the message, so the timezone will correspond to that of the author's computer. (This is true even for Gmail.) So assuming the composer isn't lying, the message was written in -1000.

Received headers, however, are added by the mail servers handling that message. Their time stamps are made when the server receives the message and will therefore correspond to the server's location. (That's the only possible option anyway – the server has no way of knowing where the client is!) It's quite possible that Google has a datacenter somewhere in -0800.

  • @JumbalayaWanton: Maybe the sender simply didn't update their timezone settings after travelling. Phones tend to do so automatically, but PCs very rarely do. – grawity Jan 5 '15 at 5:35
  • 1
    I have just found out that Google are meanly adding their own Date: header if it is missing. They do both while sending and receiving. – Ant_222 Jan 28 at 10:40
3

You are free to set your computer to whatever timezone you want. If you feel that, though you’re living in L.A., your soul is in Hawaii, you might as well set your computer to display UTC-10h.

There is absolutely no reliable relation between physical location and the timezone set on a PC.

Even worse, the date header could be completely forged. In this case, it isn’t, because the mail arrived at Google a mere 2 seconds later.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.