[Spambayes] Spam vs time-of-day

[Barry A. Warsaw]

>>>>> "TP" == Tim Peters <tim.one@comcast.net> writes:

    >> The Date header reflects local time at the spammer's box,
    >> right?  Could it be local time on a box to which the spammer
    >> connects to send his mail?  And would that box necessarily have
    >> the same local time?

    TP> Barry may know; I don't.  I have to suspect that the answer is
    TP> "it depends on the mail client".

Actually, just "it depends" would be the correct answer. :)

Of course, given the right mail client, just about anything can be
shoved into a Date header (and often is).  How far messages with bogus
or even missing Date headers will make it along the delivery path is
dependent on all the tools in the change.  Many mail clients will add
Date headers and I can't imagine such would reflect anything other
than local time on the box composing the message.  Because RFC 2822
requires exactly one Date header, an SMTPd would be within its rights
to reject a message from a client that was missing Date, although I
think all but qmail probably just add one if it's missing.  I'd bet in
99% of the situations that would have the same local time as the
composing machine.

BTW, RFC 2822 has this to say about Date:

3.6.1. The origination date field

   [...]

   The origination date specifies the date and time at which the creator
   of the message indicated that the message was complete and ready to
   enter the mail delivery system.  For instance, this might be the time
   that a user pushes the "send" or "submit" button in an application
   program.  In any case, it is specifically not intended to convey the
   time that the message is actually transported, but rather the time at
   which the human or other creator of the message has put the message
   into its final form, ready for transport.  (For example, a portable
   computer user who is not connected to a network might queue a message
   for delivery.  The origination date is intended to contain the date
   and time that the user queued the message, not the time when the user
   connected to the network to send the message.)

So I think it's safe to treat Date as the moment in time when the
human hit "send".

-Barry