3

I received some spam on gmail and I am wondering if I can fully trust the received time that gmail is displaying. Can the spammer tamper with that at all or is that attached to the headers by the gmail servers?

Edit, adding header:

Delivered-To: [email protected]
Received: by 10.49.116.82 with SMTP id ju18csp15039qeb;
        Wed, 3 Apr 2013 22:21:51 -0700 (PDT)
X-Received: by 10.60.92.201 with SMTP id co9mr2614742oeb.113.1365052911350;
        Wed, 03 Apr 2013 22:21:51 -0700 (PDT)
Return-Path: 
Received: from submasaf.com ([2607:f9d8:ea:123f::])
        by mx.google.com with ESMTP id of9si6430954obb.7.2013.04.03.22.21.51;
        Wed, 03 Apr 2013 22:21:51 -0700 (PDT)

These time stamps can't be forged/influenced right? These are stamps from the receiving machines (google)?

2 Answers 2

6

You can trust the data for the Received lines, until the line that says its connecting from a server you don't trust.

The first one can be trusted, and since it does not specify a from, probably got delivered inside google via some method besides SMTP. The next line is by mx.google.com, so can be trusted too. Google got the email from 2607:f9d8:ea:123f:: at Wed, 03 Apr 2013 22:21:51 -0700 (PDT).

2
  • I disagree. I think the only headers you can trust are the ones put in by your MTA. The reason being that one can include all the headers they want in a session - for example I can connect to your mail server and submit a message with headers i forget on behalf of google, hotmail, the whitehouse, then back to google - the only thing that will be real is what your server records about the session [came from my IP at the time your server observed].
    – Ram
    Apr 11, 2013 at 17:17
  • So we do agree, given 'until the line that says its connecting from a server you don't trust'. In this case the first recieved line isn't done over SMTP, thus doesn't report the connecting server. Checking email headers of my own gmail instance, I had similar headers. mx.google.com is the first header that does say what ip address it was connected from (2607:f9d8:ea:123f::) while the mention of submasaf.com can't specifically be trusted. Apr 11, 2013 at 21:27
0

Yes. Anyone sending an email can specify the time. Anyone can forge any un-secured mail header put on a message before you got it.

3
  • The received time? Or just the sent time?
    – cpt_fink
    Apr 11, 2013 at 1:05
  • 1
    Actually only the send time (which is part of the message headers), the received-by is appended by the receiving MTA and cannot be controlled remotely by the sender. Apr 11, 2013 at 1:20
  • Any of the timestamps or other headers that were added before it got to your trusted server (say gmail) might be forged.
    – Ram
    Apr 11, 2013 at 17:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .