Go Back > Discussions about Email Services > Email Comments, Questions and Miscellaneous
Register FAQ Members List Calendar Search Today's Posts Mark Forums Read
Stay in touch wirelessly

Email Comments, Questions and Miscellaneous Share your opinion of the email service you're using. Post general email questions and discussions that don't fit elsewhere.

Thread Tools
Old 8 Mar 2017, 09:34 PM   #1
Junior Member
Join Date: Mar 2017
Posts: 1
Change of Email Extention Old emails

Dear All,

I have a question in regards to an old email that was send. My employer is using an old email against me but I believe it has been "created". For this reason i'm not using the realistic data below.

The HR department has forwarded a message they have send to the director a year ago. At that time the HR address was, now they have forwarded the message last month but since about 6 months our extension has changed to The message send a month ago was just a direct forward from the send items folder, the message forwarded got as extension "", however the earlier communication send a year ago also has been updated to "" which makes me suspect they have changed the date it was send, and only send it last week and than directly forwarded the message again.

Is it possible for an extension to change automatically in "old" communication to the new one?

Thank you in advance for your help and if you need more information please let me know.
Maanvis is offline   Reply With Quote

Old 9 Mar 2017, 11:43 AM   #2
Intergalactic Postmaster
Join Date: May 2004
Location: Irving, Texas
Posts: 8,325
Welcome to the EMD Forums! I have an unfortunately very long and complex answer to your question. Hopefully this won't be overwhelming.

I want to point out that we can't provide legal or other professional counsel on this forum. But I can discuss what typically happens when an email is stored and then forwarded to you. As far as I know, all forwarded messages should always include the exact email From and To address including domain of the original message (if the forwarded message includes the email addresses).
  • First you should consider that an email is sent (and usually saved) as a list of text characters. Anyone can edit the complete contents of an email and change any date or anything else in the email. So many organizations have an email retention policy. Try a web search for "email retention" to learn more, and also see this Wikipedia page: Email archiving
  • So if you want to insure that you have the actual sent message, ask your management for the archived email which might have been kept by the IT department. If the email was sent to you at an account in the same email system, they may have a copy of the message as sent and as received. There is no guarantee that your organization has such an email retention policy, but you should inquire.
  • No matter where the message is retrieved from, try to get them to forward it to you as an attachment. In most cases this means that the full headers will be included, which gives you much more information.
  • Messages are commonly forwarded with the original message included inline or quoted. The exact format depends on the email client or webmail system and how it's configured by the user.
    • Inline messages commonly look similar to this:
      ----- Original message -----
      From: Sender <senderemailaddress>
      To: Recipient <recipientemailaddress>
      Subject: Restored aircraft
      Date: Sun, 05 Mar 2017 16:52:45 -0600

      Message body.
    • Quoted message commonly look similar to this:
      On Sun, Mar 5, 2017, at 04:52 PM, Sender wrote:
      > Message body.
      > Signature
    • In either of these examples it would be very easy for the person forwarding the email to change anything in the text, since it is usually editable in the compose screen.
  • With respect to the original message, if the sender doesn't actually send the message but instead cancels the compose screen, most systems give them a choice to save the message as a draft or discard it. So someone can compose a message, save it as a draft, and recall and send that draft (with changes if they wish) a year later. Usually the message date/time should be when the message is actually sent, but this is dependent on the email system. The discarded draft might be saved in the Trash folder (where it might be used later) or permanently discarded (depending on the email system or client).
  • All emails contain the Message-Id: header. You should be able to see this if you can get a copy of the original message as an attachment. The Message-Id is unique and will be different for each email sent from that email system. The format of the Message-Id header is different for various email systems, but commonly some portion of that header increases with time. For example, there might be a long number somewhere in that header which is always greater for later dates/times the email is sent. In some cases this might allow you to directly tell when the email is sent, and in other cases you could look at many messages sent by that system and bracket the date/time the message was sent. Sorry, but there is no standardized format for this header and some systems (such as Microsoft Exchange servers) tend to scramble the header so it's meaningless to us mortals.
  • Most recently sent messages will include DKIM signing. This allows the recipient to see if the message was altered. However, in most (maybe all) cases the sent copy saved by the sender won't include the DKIM header(s). If you could get a copy of the full raw message contents as it was received (by anyone it was also sent to via TO, CC, or BCC) you could probably verify (with some difficulty requiring tools) if the From, To, Subject, Date/Time sent, and message body are correct or were altered after the message was originally sent through the email server.
Sorry this explanation was so long! To recap:
  • The Date and Message-Id headers in the full raw sent message (given to you as a file attachment) may be all you can go by.
  • The From and To headers should be exactly as they were originally created (including the domain name).
  • But as I pointed out earlier, it's just a text file and is easy to change in a text editor.
  • You may be able to get an officially archived copy (if it exists) of the sent and received copies of the message, and those should be kept in a secure environment by the IT department.
  • Finally, without the server logs (which probably won't still exist from a year ago), it's difficult to see if the message was actually received. Email is a best-effort system, and unless the recipient replies that they acknowledge certain information you can't really know the message made it to the Inbox of the recipient and was actually read and understood.
n5bb is offline   Reply With Quote

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is Off
HTML code is Off
Forum Jump

All times are GMT +9. The time now is 02:02 PM.


Copyright 1998-2013. All Rights Reserved. Privacy Policy