Timestamp in email messages

Have you looked at the internal headers?  There should be timestamps there,

Indeed! The headers contain the UTM timestamps! :)

That said, it would be much more user-friendly to have them in the actual email message as well... I take it that's not possible?

I think your problem is that the user interface displays a timestamp based on when the message was received, not based on when it was sent.   This is how users expect their new email to appear.  Arrival time is also the only timestamp that cannot be forged.

I don't have a delayed message available to test this theory, but it must be true because my new messages always display at the top of the Inbox when it is sorted by date.   Since the displayed timestamp is chosen by the receiving system user interface, not by the sending system, it will be out of Sophos' control.

Obviously email clients will display the arrival time - that much is true. Again, I was hoping there's a way to put in the "send time" into the message itself, to make it readable. I checked and the header contains this information as well, as the email is sent internally by the UTM and has the following:

Received: from <hostname> (<IP>) by
 DB5EUR03FT046.mail.protection.outlook.com (10.152.21.230) with Microsoft SMTP
 [...] via Frontend Transport; Tue, 24 Apr 2018 12:06:02 +0000
Received: by localhost (Postfix, from userid 0)
    id 63B4A1A77; Tue, 24 Apr 2018 13:30:03 +0200 (CEST)

Note the time difference: sent at 13:30 (Polish time zone, so +2 hours), then received at 12:06 (UTC, so 14:06 Polish time) - meaning the message was sent after 36 minutes.

Again, the actual "case" I'm trying to deal with is finding out, from the emails, how long our network was down (a case to be made for either reimbursement from our ISP or for changing the ISP entirely). The receive times, as stated above, are not viable for this at all. The readily available "system uptime" information from the emails is helpful, but it's as helpful as the header-contained timestamps - it doesn't convey the information I'm looking for directly and one has to read into it to be able to tell what happened.

Anyway, I'll mark the first answer at the correct one. It doesn't really solve my issue, but I recognize that what I'm looking for probably isn't available in the current implementation of UTM. Still, it'd be nice if it was available... ;)

You are right, it should be in the message body.   Post the request in ideas.sophos.com

Apparently, this was already posted by someone else:

https://ideas.sophos.com/forums/17359-sg-utm/suggestions/2560701-notifications-include-system-time-in-event-notifi

It's a bit worrisome that the idea was posted in 2012! Over 5 years ago, and it still hasn't been implemented... :(

As if it is a difficult change to implement...

In the email header, you should see two lines like the following that tell you exactly when the email was generated:

Received: by localhost (Postfix, from userid 0)
	id F19xxxxx537; Sun,  3 Jun 2018 13:41:07 -0500 (CDT)

In the lines above that, you should see when the email was finally sent successfully.

You also could get this information from smtp.log and notifier.log would also list the exact moment the alert was generated.

Cheers - Bob