As the headline says:
I have got a bunch of spam messages which I am currently investigating for certain reasons. The spammers have set the "Date:" header far in the fut… (read more)
As the headline says:
I have got a bunch of spam messages which I am currently investigating for certain reasons. The spammers have set the "Date:" header far in the future (e.g. 2026-01-04), and the "Date" column in the message list as expected shows these weird dates.
However, the "Received" column in the message list as well shows the same weird dates although the topmost "Received:" header in every message is correct.
Here is an excerpt from the header section of one of those messages which shows the "Date:" header and all "Received:" headers (sorry that I couldn't find out how to format the following passage as code):
Date: Thu, 14 Jan 2026 03:38:55 -0800
Received: from deliver ([unix socket])
by morn (Cyrus 3.0.8-Debian-3.0.8-6+deb10u5) with LMTPA;
Fri, 05 Mar 2021 12:17:37 +0100
Received: from pop.example.com [a.b.c.d]
by morn.dep01.example.com with POP3 (fetchmail-6.4.0.beta4)
for <user@localhost> (single-drop); Fri, 05 Mar 2021 12:17:37 +0100 (CET)
Received: from server.spammer.com ([e.f.g.h])
by odysseus.example.com (8.15.2/8.15.2/Debian-14~deb10u1) with ESMTP id 125BHDIJ001425
for <user@example.com>; Fri, 5 Mar 2021 12:17:13 +0100
Received: from imap-director-5.dovecot.xion.foo.bar (i.j.k.l)
by imap-backend-28.dovecot.xion.foo.bar with LMTP
id [an22]
(envelope-from <bounces+XmuZjwsANPH/dOCq73______________3@mail.randomcharactershere.com>)
for <to>; Thu, 14 Jan 2026 03:38:55 -0800
Please note that there are other headers between the ones shown above. I have removed these other headers. I did not change the order of the headers shown above.
Of course, I am aware that the last "Received:" header causes the problem. But this at once leads to the question how TB chooses the "Received:" header from which it extracts the date / time to display in the "Received" column.
As far as I know, SMTP servers and other software involved in the transportation of messages must put their own "Received:" header (if any) above all other "Received:" headers, so that we can reproduce how the message hopped through the net by reading all "Received:" headers from bottom to top. That is, the "Received:" header which reflects delivery to the IMAP server my MUA is connected to always must be topmost.
TB obviously does the opposite (consider the bottom-most "Received:" header the most recent one, i.e. the one whose date should be displayed in the "Received:" column), or it is trying to be overly smart (sort the "Received:" headers by their date, consider the "Received:" header with the "highest" date to reflect the last hop, and consequently display that "highest" date in the "Received:" column). Both would be wrong.
Could anybody please show me how to get around that situation? Is there an extension which does it right? Is it correct that (according to the SMTP RFCs) each software component must put its "Received:" header (if any) above all other "Received:" headers as the message flows through the net?
Thank you very much in advance!
P.S. As a bonus, could somebody please explain how to format something as code here?