Sent email time difference

Hi Experts,

I have a client site with SBS 2008 and Terminal Server 2008 R2 running on Esxi 4.0.  The issues lies with the email time stamp.  

When the email is recieved, the time that it was sent is an hour  early eg The email below was sent at 7:05 (as per the subject line) however it is stamped as 6:05.

date Tue, Mar 1, 2011 at 6:05 AM
subject 7:05

We live in Perth Western Australia where there was daylight savings, now there is not - I have checked both servers and the they state they are in the correct time zone and are reporting the correct time.  They also correctly state that there is no daylight savings in this time zone.  I do not understand where this time stamp may be coming from.  

Any assistance on this one would be appreciated.  
domdigAsked:
Who is Participating?
 
domdigConnect With a Mentor Author Commented:
There was apparently a second NIC used for testing at some stage that was still active.  Somehow the traffic was passing from one interface to the other and getting the time stamps mixed up on the way though.  

Disabling the second NIC resolved the issue.
0
 
pmorton23Commented:
can you please post full header info from one of the emails in question. does this happen for every email or just ceratin ones.
0
 
pmorton23Commented:
the timestamp could be coming from a firewall or the last hop to the internet.
0
Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

 
domdigAuthor Commented:
Full unedited email headers are below

Received: from out11.sjc.mx.trendmicro.com (216.99.131.48) by
 remote.domaindigital.com.au (192.168.3.248) with Microsoft SMTP Server (TLS)
 id 8.1.393.1; Tue, 1 Mar 2011 07:03:16 +0800
Received: from in11.sjc.mx.trendmicro.com (unknown [10.30.239.134])      by
 out11.sjc.mx.trendmicro.com (Postfix) with ESMTP id 8F44F980436      for
 <charlie@domaindigital.com.au>; Mon, 28 Feb 2011 23:03:13 +0000 (UTC)
Received: from outbound.icp-qv1-irony-out6.iinet.net.au (unknown
 [203.59.1.109])      by in11.sjc.mx.trendmicro.com (Postfix) with ESMTP id
 CC7E6B3B02A      for <charlie@domaindigital.com.au>; Mon, 28 Feb 2011 23:03:11
 +0000 (UTC)
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: Av0EAPu3a03LO431/2dsb2JhbACCTqN3dLtVhWEEhQ2HD4NY
X-IronPort-AV: E=Sophos;i="4.62,243,1297008000";
   d="scan'208,217";a="216358990"
Received: from unknown (HELO companyweb.city-life.com.au) ([203.59.141.245])
  by outbound.icp-qv1-irony-out6.iinet.net.au with ESMTP/TLS/AES128-SHA; 01
 Mar 2011 07:03:09 +0800
Received: from CLSBS.city-life.local ([fe80::50ca:7523:20ab:2c4c]) by
 CLSBS.city-life.local ([fe80::50ca:7523:20ab:2c4c%13]) with mapi; Tue, 1 Mar
 2011 08:03:07 +0900
From: City-Life Admin <cladmin@city-life.com.au>
To: "'charlie@domaindigital.com.au'" <charlie@domaindigital.com.au>
Date: Tue, 1 Mar 2011 07:03:07 +0900
Subject: 7:03
Thread-Topic: 7:03
Thread-Index: AcvXm6tuz+Lb7rSPRO2oSaLcCZcjfg==
Message-ID: <2D702F83362F6F46AAFC145432A5906E67431EA3CF@CLSBS.city-life.local>
Accept-Language: en-US, en-AU
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
acceptlanguage: en-US, en-AU
X-TM-AS-Product-Ver: SMEX-8.6.0.1374-6.500.1024-17608.004
X-TM-AS-Result: No--2.939200-5.000000-31
X-TM-AS-User-Approved-Sender: No
X-TM-AS-User-Blocked-Sender: No
Content-Type: multipart/alternative;
      boundary="_000_2D702F83362F6F46AAFC145432A5906E67431EA3CFCLSBScitylife_"
MIME-Version: 1.0
X-TM-AS-Result-Detail: Spam:No-Score:-4.7681-Baseline:ModeratelyHigh-Other:Lowest
X-TM-AS-URLRatingInfo: 81-38-=?us-ascii?B?aHR0cDovL3NjaGVtYXMubWljcm9zb2Z0Lm
      NvbS9vZmZpY2UvMjAwNC8xMi9vbW1s?=
X-TM-AS-URLRatingAct: 60-Delivered
Return-Path: cladmin@city-life.com.au
X-MS-Exchange-Organization-PRD: city-life.com.au
X-MS-Exchange-Organization-SenderIdResult: None
Received-SPF: None (DOMAINSBS.domaindigital.local: cladmin@city-life.com.au
 does not designate permitted sender hosts)
X-MS-Exchange-Organization-SCL: 0
0
 
pmorton23Commented:
Received: from unknown (HELO companyweb.city-life.com.au) ([203.59.141.245])
  by outbound.icp-qv1-irony-out6.iinet.net.au with ESMTP/TLS/AES128-SHA; 01
 Mar 2011 07:03:09 +0800
Received: from CLSBS.city-life.local ([fe80::50ca:7523:20ab:2c4c]) by
 CLSBS.city-life.local ([fe80::50ca:7523:20ab:2c4c%13]) with mapi; Tue, 1 Mar
 2011 08:03:07 +0900
From: City-Life Admin <cladmin@city-life.com.au>
To: "'charlie@domaindigital.com.au'" <charlie@domaindigital.com.au>
Date: Tue, 1 Mar 2011 07:03:07 +0900

clsbs.city-life.local is showing a timestamp of 803
this server has incorrect time or is in a different timezone.
0
 
pmorton23Commented:
there is also a difference in the UTC number. the first stamp shows utc of +9 and the later ones show utc of +8. unless the servers in a differnet time zone they should be the same.
0
 
domdigAuthor Commented:
OK - Thanks - Good spot - I can see this now you have pointed it out.  The next question is "why"

This server is in the correct time zone (Perth GMT +8) with the correct time.  

Where else can I look to determine where this issue may lie?
0
 
pmorton23Commented:
check the ironport boxes and the trendmicro
0
 
domdigAuthor Commented:
OK - the iron port is with the ISP.  This might take a while.....

Thanks for your assistance.  Will report back.  

0
 
pmorton23Commented:
it might be an issue with the ISP then. emails are delivered on time they just show the wrong stamp. good luck
0
 
PostmasterCommented:
Time stamps are converted into the correct zone by sender and recipient machines.
So if the sender has the wrong settting, then nothing you do can fix that.

Your recipient simply takes the provided value (in GMT) and converts it for display.

To: "'charlie@domaindigital.com.au'" <charlie@domaindigital.com.au>
Date: Tue, 1 Mar 2011 07:03:07 +0900

The sender time zone is wrong. (should be +0800)
All your servers correctly stamp the message with +0800 as the mail moves from one to the other.
0
 
domdigAuthor Commented:
I am no longer thinking this is an ISP issue.....

Looking at the following:

Received: from CLSBS.city-life.local ([fe80::50ca:7523:20ab:2c4c]) by
 CLSBS.city-life.local ([fe80::50ca:7523:20ab:2c4c%13]) with mapi; Tue, 1 Mar
 2011 08:03:07 +0900

This looks to be a IPv6 address from the source server - Could there be somthing strange happening here as it appears to be where the time changes to +900?
0
 
domdigAuthor Commented:
I could not find a reason why there would be a time difference between the two NICs - Comments on this may be useful.  The issue is however resolved.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.