2

The following email was marked to have been sent on the 15th August however it was received on the 6th September.

All of the datestamps on the email except for the first one are for the 6th September (some are the 7th but that's because the receiving server was PDT rather than GMT).

The sender is claiming that this email was sent from their machine on the 15th August, almost three weeks before. Is it possible that this is true? Is there any way that it could have left their machine and then got stuck somewhere until the 6th?

First email: all timestamps are dated three weeks after the 'sent' date

Delivered-To: xxxxxxxx
Received: by 10.231.4.202 with SMTP id 10cs144069ibs;
        Tue, 6 Sep 2011 20:25:32 -0700 (PDT)
Received: by 10.227.152.129 with SMTP id g1mr5802672wbw.56.1315365931065;
        Tue, 06 Sep 2011 20:25:31 -0700 (PDT)
Return-Path: <xxxxxxxx>
Received: from coumta04.netbenefit.co.uk (coumta04.netbenefit.co.uk [95.130.76.115])
        by mx.google.com with ESMTP id 21si9249722wbw.107.2011.09.06.20.25.29;
        Tue, 06 Sep 2011 20:25:30 -0700 (PDT)
Received-SPF: neutral (google.com: 95.130.76.115 is neither permitted nor denied by best guess record for domain of xxxxxxxx) client-ip=95.130.76.115;
Authentication-Results: mx.google.com; spf=neutral (google.com: 95.130.76.115 is neither permitted nor denied by best guess record for domain of xxxxxxxx) smtp.mail=xxxxxxxx
Received: from [84.252.254.11] (port=1257 helo=xxxxxxxx)
    by coumta04.netbenefit.co.uk with esmtp (NBT 4.72 2)
    id 1R18lR-0001SR-DZ
    for xxxxxxxx; Wed, 07 Sep 2011 04:25:29 +0100
Return-Receipt-To: "xxxxxxxx" <xxxxxxxx>
Subject: xxxxxxxx
Date: Mon, 15 Aug 2011 15:51:10 +0100
Message-ID: <xxxxxxxx>
X-MS-Has-Attach: yes
MIME-Version: 1.0
Content-Type: multipart/related;
    type="multipart/alternative";
    boundary="----_=_NextPart_001_01CC5B5A.C52AC300"
X-MS-TNEF-Correlator: 
Thread-Topic: xxxxxxxx
Thread-Index: xxxxxxxx
Disposition-Notification-To: xxxxxxxx
Content-class: urn:content-classes:message
From: xxxxxxxx
X-MimeOLE: Produced By Microsoft Exchange V6.5
To: xxxxxxxx
X-NB-Virus-Scan: virus-free
X-Originally-To: xxxxxxxx

This is a multi-part message in MIME format.

------_=_NextPart_001_01CC5B5A.C52AC300
Content-Type: multipart/alternative;
    boundary="----_=_NextPart_002_01CC5B5A.C52AC300"


------_=_NextPart_002_01CC5B5A.C52AC300
Content-Type: text/plain;
    charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

xxxxxxxx

------_=_NextPart_002_01CC5B5A.C52AC300

xxxxxxxx

------_=_NextPart_002_01CC5B5A.C52AC300--

------_=_NextPart_001_01CC5B5A.C52AC300
Content-Type: image/jpeg;
    name="xxxxxxxx"
Content-Transfer-Encoding: base64
Content-Description: xxxxxxxx
Content-Location: xxxxxxxx

xxxxxxxx

------_=_NextPart_001_01CC5B5A.C52AC300--

EDIT

There was a second email that arrived simultaneously with the first. Both emails came from the same company however they were from different individuals and presumably computers at that company. Although a possible answer is that the individual forgot to press "send and receive" for three weeks or that the email got caught in Outlook it becomes far less likely with two such emails.

Second simultaneous email sent by a different person at the same company (2wks later)

The company did not claim or complain of any internet outage during this period. Note that the first hop of the second email is 7 seconds before the first hop of the previous email while the "sent date" is apparently two weeks later:

Delivered-To: xxxxxxxx
Received: by 10.231.4.202 with SMTP id 10cs144068ibs;
        Tue, 6 Sep 2011 20:25:26 -0700 (PDT)
Received: by 10.216.229.88 with SMTP id g66mr2963523weq.9.1315365924837;
        Tue, 06 Sep 2011 20:25:24 -0700 (PDT)
Return-Path: <xxxxxxxx>
Received: from coumta04.netbenefit.co.uk (coumta04.netbenefit.co.uk [95.130.76.115])
        by mx.google.com with ESMTP id u35si8835621weq.122.2011.09.06.20.25.23;
        Tue, 06 Sep 2011 20:25:23 -0700 (PDT)
Received-SPF: neutral (google.com: 95.130.76.115 is neither permitted nor denied by best guess record for domain of xxxxxxxx) client-ip=95.130.76.115;
Authentication-Results: mx.google.com; spf=neutral (google.com: 95.130.76.115 is neither permitted nor denied by best guess record for domain of xxxxxxxx) smtp.mail=xxxxxxxx
Received: from [84.252.254.11] (port=1257 helo=xxxxxxxx)
    by coumta04.netbenefit.co.uk with esmtp (NBT 4.72 2)
    id 1R18lO-0001SR-G0
    for xxxxxxxx; Wed, 07 Sep 2011 04:25:23 +0100
Subject: xxxxxxxx
Date: Tue, 30 Aug 2011 10:49:00 +0100
Message-ID: <xxxxxxxx>
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator: 
MIME-Version: 1.0
Content-Type: multipart/related;
    type="multipart/alternative";
    boundary="----_=_NextPart_001_01CC66FA.0B9BFD72"
Thread-Topic: xxxxxxxx
Thread-Index: Acxm+gtdtV3BSonSR826xyTFQoiE9w==
From: "xxxxxxxx" <xxxxxxxx>
Content-class: urn:content-classes:message
To: <xxxxxxxx>
X-MimeOLE: Produced By Microsoft Exchange V6.5
Cc: "xxxxxxxx" <xxxxxxxx>
X-NB-Virus-Scan: virus-free
X-Originally-To: xxxxxxxx

This is a multi-part message in MIME format.

------_=_NextPart_001_01CC66FA.0B9BFD72
Content-Type: multipart/alternative;
    boundary="----_=_NextPart_002_01CC66FA.0B9BFD72"


------_=_NextPart_002_01CC66FA.0B9BFD72
Content-Type: text/plain;
    charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
xxxxxxxx

------_=_NextPart_002_01CC66FA.0B9BFD72
Content-Type: text/html;
    charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
xxxxxxxx

------_=_NextPart_002_01CC66FA.0B9BFD72--
xxxxxxxx

------_=_NextPart_001_01CC66FA.0B9BFD72
Content-Type: image/jpeg;
    name="xxxxxxxx"
Content-Transfer-Encoding: base64
Content-Description: xxxxxxxx
Content-Location: xxxxxxxx

xxxxxxxx

------_=_NextPart_001_01CC66FA.0B9BFD72--

I know that changing the computer clock will cause Outlook to give an outgoing mailstamp equivalent to this one however I would like to know whether there is any legitimate reason for this.

3 Answers 3

7

No, this is not possible. At least not really.

Received: from [84.252.254.11] (port=1257 helo=xxxxxxxx)
    by coumta04.netbenefit.co.uk with esmtp (NBT 4.72 2)
    id 1R18lR-0001SR-DZ
    for xxxxxxxx; Wed, 07 Sep 2011 04:25:29 +0100
Date: Mon, 15 Aug 2011 15:51:10 +0100

This indicates that the mail was written in August. May be forged but possible and lets assume that this was really written in August. But the first received line indicates the first real mail server that got the mail. And this was in September. This line could have been forged, too, but who should forge it against him?

So what could have happened?

  • The user set the clock back to August to lie to you, but as he has no control over the (first) server, this one revealed the lie.
  • The user wrote the mail in August and put the mail in the "Outbox" at his client (Outlook). From where it was never sent until he pushed the "Send and Receive" button.
  • The user wrote the mail in August and put the mail in the "Draft" folder. Then he noticed the mistake in September and hit the "Send" button.

For whatever is true (could be a scenario I haven't thought of) the mail reached the first server in September (or what the server thought was September). But the problem is on the client side (either user, software, network or the like).

Edit

Or as you found out there is a last scenario: The first server was down and couldn't accept the mail at all. The client tried and tried but didn't succeed until the admin restarted the server in September. Or something else that "broke" the first server to accept the mail(s).

5
  • Thank you, good explanation. Given that there was also a second email (see edit above) from a different person at the same company, can you see any plausible explanation for both of them? Oct 28, 2011 at 16:13
  • If the server was down, wouldn't the client have received an NDR or at least a delay notification?
    – DKNUCKLES
    Oct 28, 2011 at 17:09
  • If the first server was down, the mail client wouldn't even have been able to submit the mail. Oct 28, 2011 at 17:59
  • 1
    That's true. But I know many people that see error messages and ignore them after they read them more than 4 times. But server time doesn't lie in most of the cases. So I trust them more than client time. As I said, all headers (except the top received line) could be forged and shouldn't be trusted.
    – mailq
    Oct 28, 2011 at 18:57
  • Since there's no clear answer to this question I'm not going to vote any particular one as correct (my bad for asking a subjective question) but have upvoted both your answer and your comment Oct 30, 2011 at 22:55
3

Yes, it's possible, if it was held in an internal queue on the sending side. From whois, the sending IP seems to be in an xDSL block, it's quite possible that the internal mail software was unable to get on-line and queued it. If that's a complete set of headers, there was no internal mail server queueing it up (that normally results in a bounce after 5-7 days of "unable to deliver").

Queued up in the mail client, there's no well-defined "best practices" for how long to hold on to the email before giving up, but I'd expect the timestamps from multiple mails to be (roughly) the same, if they've been queued in the client.

6
  • Thank you. Would that also be consistent with a second email sent from a different person at the same company but on a different machine going out at the same time despite being sent 16 days later. The first hop on the two emails was within 7s of each other. Oct 28, 2011 at 15:21
  • 1
    If the problem was, say, "the DSL link was broken for several weeks" (or "unstable enough that it never completed sending the email"), possibly. The DSL situation in Britain is... interesting. There are usually multiple parties involved, the ISP providing the connection to the internet at large, the ex-monopoly telco (or another operator!) providing infrastructure to haul the traffic from the consumer to the ISP and (sometimes, but that is probably pretty rare) another provider of the last little bit of cable (more "the last few yards" than "the last mile").
    – Vatine
    Oct 28, 2011 at 15:53
  • That makes sense but do you think it's plausible if the company had found all other email to be "as normal" and there was also a second email from a different individual in the company (see my edit) Oct 28, 2011 at 16:12
  • @peter nixey: I'd prefer to not speculate on that. :) I've speculated on the possibility, but as far as "probability" and "plausibility", I'd really want to know the human actors good enough.
    – Vatine
    Oct 28, 2011 at 16:46
  • Understood - Fair enough :) Oct 29, 2011 at 13:31
0

Just to note:

It's the same source host (84.252.254.11) and same (rather big) delay between writing e-mail (assume Date header is correct) and first MTA time in route.

X-MS-Has-Attach: yes
X-MS-TNEF-Correlator
X-MimeOLE

Tells me, that it's some Exchange, which collected mail sent from client's Outlook (without SMTP, thus we can't see real endpoints), claim as successfully received to user, but - not sent to Net nor generate NDR for users for a long-long time

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .