Question

I’ve had this noted down on some of my code for a while:

/**
 * Add a BCC.
 *
 * Note that according to the conventions of the SMTP protocol all
 * addresses, including BCC addresses, are included in every email as it
 * is sent over the Internet. The BCC addresses are stripped off blind
 * copy email only at the destination email server.
 *
 * @param string $email
 * @param string $name
 * @return object Email
 */

I don’t remember where I got it from (possible source) but that shouldn’t be relevant to this question. Basically, whenever I try to send an email with BCCs via SMTP the BCC addresses are not hidden – I’ve read the whole RFC for the SMTP protocol (a couple years ago) and I don’t think I’m missing anything.

The strange thing is, if I send an email with BCCs using the built-in mail() function everything works just right and I’ve no idea why – I would like to roll my own email sender but I fail to understand this.

Can someone please shed some light into this dark subject?

Answer 1

The BCC addresses are not stripped off at the destination email server. That’s not how it works.

How SMTP actually works

• The sender will send a list of RCPT TO commands to the SMTP server, one for each receiver email addresses, and this command does not distinguish whether the receiver is a normal To, CC or BCC type receiver.
• Soon enough after calling the command that tells the SMTP server who’s the sender, who’s the server, and everything else, only then the sender will call the DATA command, in which will contain the content of the email – which consist of the email headers and body – the one that are received by email clients. Among these email headers are the usual from address, to address, CC address.
• The BCC address is not shown to the receiver, simply because it’s not printed out under the DATA command, not because the destination SMTP server stripped them away. The destination SMTP server will just refer to the RCPT TO for the list of email addresses that should receive the email content. It does not really care whether the receiver is in the To, CC or BCC list.
  Update (to clarify): BCC email addresses must be listed in the RCPT TO command list, but the BCC header should not be printed under the DATA command.

Quoting a part of the RFC that I think is relevant to your case:

Please note that the mail data includes the memo header items such as Date, Subject, To, Cc, From [2].

Rolling out your own email sender

A couple of years ago, I frankly think, is quite a long time back to assume that you still memorize end-to-end of RFC 821. 🙂