Tools · Email security · 19 / 26
The Date header is not the hop time
The Date header is a clock the sending software wrote. The time on the Received line your provider added is when that hop accepted the message. Write both, and do not file Date as the arrival time.
Date is the sender clock
The Date header is a timestamp inside the message. The software that created the message set it. It can match a real send, or it can be hours off because a laptop clock was wrong. It is not a log line from your mail gateway.
If Date is missing, write “Date not in this copy.” Do not fill it from a Received line.
The hop time is on Received
The Received line added by your provider includes the time that server accepted the message. That is the arrival time at the boundary you operate. Later internal hops have their own times. Use the provider hop when you say when the message reached you.
A gap between Date and that hop is a fact. It can be queueing, a clock skew, or a Date value you should not treat as arrival. The gap alone does not explain which.
What to write down
File Date, the provider Received timestamp, and which host added that Received line. Label them. A sentence that says “received at” has to name the hop, not the Date header.
Lab: 09:00 in Date and 10:40 at the gateway
A saved lab message shows Date: Mon, 2 Nov 2026 09:00:00 +0000. The Received line added by mx.example.org says Mon, 2 Nov 2026 10:40:11 +0000. A draft says the message arrived at 09:00.
The note quotes 09:00 as Date and 10:40:11 as the mx.example.org hop. Arrival at that gateway is 10:40:11 UTC. The draft sentence is replaced. The gap stays in the note without a guessed cause.
Date: Mon, 2 Nov 2026 09:00:00 +0000 Received by mx.example.org: Mon, 2 Nov 2026 10:40:11 +0000 write: Date 09:00, hop 10:40:11 not: arrived at 09:00
Diagram
Two clocks on one message
Only the hop you trust dates arrival at your gateway.
Set by. The sending software
Means. The time that software wrote
Does not. Log when your gateway accepted the message
Set by. The hop your provider added
Means. When that server accepted it
Use. When you say the message arrived there
Check yourself
1. What does the Date header record?
2. Your provider hop says 10:40 and Date says 09:00. Which time is arrival at that hop?
3. Date is missing. What do you write?