Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I received some spam on gmail and I am wondering if I can fully trust the received time that gmail is displaying. Can the spammer tamper with that at all or is that attached to the headers by the gmail servers?

Edit, adding header:

Delivered-To: me@gmail.com
Received: by 10.49.116.82 with SMTP id ju18csp15039qeb;
        Wed, 3 Apr 2013 22:21:51 -0700 (PDT)
X-Received: by 10.60.92.201 with SMTP id co9mr2614742oeb.113.1365052911350;
        Wed, 03 Apr 2013 22:21:51 -0700 (PDT)
Return-Path: 
Received: from submasaf.com ([2607:f9d8:ea:123f::])
        by mx.google.com with ESMTP id of9si6430954obb.7.2013.04.03.22.21.51;
        Wed, 03 Apr 2013 22:21:51 -0700 (PDT)

These time stamps can't be forged/influenced right? These are stamps from the receiving machines (google)?

share|improve this question

2 Answers 2

up vote 6 down vote accepted

You can trust the data for the Received lines, until the line that says its connecting from a server you don't trust.

The first one can be trusted, and since it does not specify a from, probably got delivered inside google via some method besides SMTP. The next line is by mx.google.com, so can be trusted too. Google got the email from 2607:f9d8:ea:123f:: at Wed, 03 Apr 2013 22:21:51 -0700 (PDT).

share|improve this answer
    
I disagree. I think the only headers you can trust are the ones put in by your MTA. The reason being that one can include all the headers they want in a session - for example I can connect to your mail server and submit a message with headers i forget on behalf of google, hotmail, the whitehouse, then back to google - the only thing that will be real is what your server records about the session [came from my IP at the time your server observed]. –  Ram Apr 11 '13 at 17:17
    
So we do agree, given 'until the line that says its connecting from a server you don't trust'. In this case the first recieved line isn't done over SMTP, thus doesn't report the connecting server. Checking email headers of my own gmail instance, I had similar headers. mx.google.com is the first header that does say what ip address it was connected from (2607:f9d8:ea:123f::) while the mention of submasaf.com can't specifically be trusted. –  becomingwisest Apr 11 '13 at 21:27

Yes. Anyone sending an email can specify the time. Anyone can forge any un-secured mail header put on a message before you got it.

share|improve this answer
    
The received time? Or just the sent time? –  cpt_fink Apr 11 '13 at 1:05
1  
Actually only the send time (which is part of the message headers), the received-by is appended by the receiving MTA and cannot be controlled remotely by the sender. –  Martino Dino Apr 11 '13 at 1:20
    
Any of the timestamps or other headers that were added before it got to your trusted server (say gmail) might be forged. –  Ram Apr 11 '13 at 17:19

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.