why do some emails have impossible (past) dates?

2

I just got a spam email dated 1970/1/1. I laughed, but then thought about it a bit more. I get these from time to time - always spam - and assumed they did this to stand out in your inbox.

But I'm curious how this can happen?

Drew

Posted 2011-02-22T10:40:29.997

Reputation: 1 682

Answers

3

1970/1/1 is the Unix epoch start time, see http://en.wikipedia.org/wiki/Unix_time .

Unix and Linux systems count the time in seconds starting at 1970/1/1, probably, when no date has been set at all in the mail headers, this starting time is set by default by the MTA or showed by default by your mail client.

rems

Posted 2011-02-22T10:40:29.997

Reputation: 1 850

probably, when no date has been set at all in the mail headers -- so dates are spoofable? – Drew – 2011-02-22T13:07:52.090

@Andrew: Most emails have several date stamps. The one displayed by your mail client is the Date header, which is spoofable easily. It's just a piece of text added by the sender's mail program, after all. (The timestamps in Received headers are added by the mail servers themselves, so they are more reliable, but the Received headers can themselves be faked.) Use your mail program's "View source" or "View headers" command to see all headers. – user1686 – 2011-02-22T14:01:46.100

@andrew: The entire header is spoofable. Unencrypted email is the definition of insecure. – Satanicpuppy – 2011-02-22T14:37:27.797

The only thing you can trust is the last received entry. Everything else is spoofable. – hlovdal – 2011-02-24T00:05:49.587