Sandee said:
If someone sends me an email and has a third person in the bcc (that I can't
see), and I reply to the email, does the third person in the bcc receive the
reply as well?--
Nope. That's why it is called the BLIND Carbon Copy field. If you were
blind to the recipients listed there, it would be called a blind field.
No recipient of the e-mail gets to see who, if anyone, was specified by
the sender in the Bcc *field* shown in their e-mail client. I say
*field* because that is not anything used by the mail server to specify
who are the recipients of an e-mail, and neither are the To and Cc
fields. The e-mail client compiles an aggregate list of recipients from
the To, Cc, and Bcc *fields* in its UI to create a list of RCPT-TO
commands that it sends to the mail server. The mail server doesn't read
those headers to determine where to send the e-mail. It gets the
RCPT-TO commands from the client telling it where to send the e-mail.
Recipients never get to see the list of RCPT-TO commands between the
sender's e-mail client and the sender's e-mail server.
Blind means blind. Recipients are blind to whomever was specified in
the Bcc field in the e-mail client used by the sender. No such header
is added to the e-mail. The To, Cc, and Bcc fields are not used by the
mail server to identify the recipients.
Seen in sender's e-mail client UI:
To: personA,personB
Cc: personC,personD
Bcc: personE
Sent from sender's e-mail client to their mail server:
RCPT TO personA <---.
RCPT TO personB |
RCPT TO personC |--- recipients never get to see this
RCPT TO personD |
RCPT TO personE <---'
DATA
<headers shown in e-mail client's UI except Bcc> <----.
<blank delimiter line> |
<body of message> |
|
this is what recipients get to see ---'
(plus any Received headers prepended by
each mail host in the delivery route)
The DATA transmits whatever the e-mail client puts inside the message
(headers section, blank delimiter line, body). The e-mail client
decides whatever it wants to put in the headers section. The data for
the message is NOT used to specify recipients (that was already done by
the RCPT-TO commands the e-mail client sent to the mail server). That
is how spammers can put anything they want in the To/Cc fields because
they are in the *data* of the message. They could even add spam into
those fields that aren't e-mail addresses or even leave them blank. The
data is not used to specify the recipients.
When you reply, your e-mail client only has the list of e-mail addresses
that it can extract from the *data* of the message. It has no access to
the list of RCPT-TO commands used by the sender's e-mail client. A
correctly defined e-mail client will NOT insert the contents of its Bcc
*field* into the header section of the message's *data*. The recipient
is BLIND to whatever was in that *field* in the sender's e-mail client.
