Dates and times in message headers are, almost always, given in the localtime for the computer that wrote the header. So, the Date header on a message will be the localtime where the message was sent, not where it was received. Received: headers are timestamped local to the computer that handled them. So, how can you tell when it was actually handled, in your own local time?
Email timestamps use the following format:
- abbreviated day of the week,
- day of the month
- abbreviated month
- year
- hour (in 24 hour time)
- minute
- second
- offset from Greenwich Mean Time
- abbreviation for timezone
Here's a pair of timestamps from a message I got recently:
Thu, 9 Jun 2011 13:35:55 -0400 (EDT)
Thu, 9 Jun 2011 10:35:50 -0700 (PDT)
Without the last 2 elements, you might say, "What?! Why did this message take 3 hours to deliver?!?" However, the last 2 elements indicate where the messages were when they got timestamped. The first line was written in Philadelphia, during Eastern Daylight Time (EDT). The second line was written in California, during Pacific Daylight Time (PDT).
That might be enough information if you live in the United States, but if you don't, or the message was handled in a part of the world where you aren't familiar with their timezone abbreviations, what can you do? That's where the offset from Greenwich Mean Time comes in! Greenwich Mean Time (or GMT) is also known as UTC, or Coordinated Universal Time, and it is the Internet standard for time. All timezones are also indicated in email as their offset from GMT.
So, in the examples above, -0400 indicates 4 hours after GMT and -0700 indicates 7 hours after GMT. If the message was sent from, say, New South Wales, the offset would be +1000, or 10 hours before GMT. Using this structure, you could convert all the timestamps in a message to GMT, if you wanted to. That would make the first timestamp 17:35:55 in GMT, and the second one .... 17:35:50! So, that message actually took 5 seconds to process, not 3 hours and 5 seconds.