Why am I able to see bcc addressees…?

[WSVictor Delta]

Something very odd is happening and I can’t quite believe it!

I can access my emails via MS Outlook on my home pc and also my iPhone. Recently, I’ve noticed that I can see the bcc (blind carbon copy) addressees in full (ie names and email addresses) on some emails on my iPhone, although they appear correctly (ie without showing the bcc addresses) on MS Outlook.

I can hardly believe this is possible because, as I understand it, the bcc address info is not sent to other recipients – so it should not be there for me to see.

All of my software is fully up to date. I’ve checked and I can see the bcc info on another iPhone too when accessing my email account.

Can anyone explain what is happening please, and has anyone else experienced it…?

[mn–]

WSVictor Delta wrote:

although they appear correctly (ie without showing the bcc addresses) on MS Outlook.

That’s normally a sender-side application bug. Those came up once every few years in some application or another. The initial SMTP sending application is supposed to generate a recipient listing and at that time drop the bcc line from header data.

Some mail relay servers have also been known to strip a Bcc header from mails, but the SMTP spec doesn’t require them to.

Outlook has been known to, among other things, hide bcc fields in received mail. I’m told this is a “Feature”(tm). Features such as this are the main reason why I tell newbie mail server admins to not use Outlook with any mailbox on their servers… it hides technical things they need to see for their admin work. In this case, hiding someone else’s bug.

1 user thanked author for this post.

WSVictor Delta

[WSVictor Delta]

Thanks for that. The emails I’ve noticed this on came from someone using the Windows 10 Mail app…!

[Nathan Parker]

Is this using the Mail app on iPhone or the Outlook app on iPhone?

Nathan Parker

[WSVictor Delta]

Nathan Parker wrote:

Is this using the Mail app on iPhone or the Outlook app on iPhone?

I’m using the standard, built-in, Mail app on my iPhone.

[WSVictor Delta]

Mine is an iPhone 6. My wife’s iPhone 5 gives the same result.

However, a friend’s iPhone 8 doesn’t show the bcc addresses on the same emails.

All are using the latest software available.

• This reply was modified 4 months ago by WSVictor Delta.

[Paul T]

This just means the BCC info was left in by the sending mail program / server and some mail clients choose not to show it.

cheers, Paul

[WSVictor Delta]

Paul T wrote:

This just means the BCC info was left in by the sending mail program / server and some mail clients choose not to show it.

cheers, Paul

Yes, but it’s pretty poor of the Windows 10 Mail app to do this as it could cause the sender to unwittingly breach GDPR.

When you send an email with bcc addressees, you don’t expect them to be visible to some recipients.

• This reply was modified 4 months ago by WSVictor Delta.

[mn–]

WSVictor Delta wrote:

When you send an email with bcc addressees, you don’t expect them to be visible to some recipients.

… according to https://answers.microsoft.com/en-us/windows/forum/all/win-10-mail-not-showing-bcc-of-my-sent-emails/a2ee10d8-6fcf-43ad-8aa4-2ab76c04b49e they’re not visible to sender. As in can’t check the bcc field of sent (archived) messages. Recipients still get them…?

Really feels like someone might have very severely misunderstood what the bcc is supposed to do.

Right. Don’t use Windows 10 Mail for anything. Also should check if this holds for all versions or just some.

[jabeattyauditor]

WSVictor Delta wrote:

Something very odd is happening and I can’t quite believe it!

I can access my emails via MS Outlook on my home pc and also my iPhone. Recently, I’ve noticed that I can see the bcc (blind carbon copy) addressees in full (ie names and email addresses) on some emails on my iPhone, although they appear correctly (ie without showing the bcc addresses) on MS Outlook.

I can hardly believe this is possible because, as I understand it, the bcc address info is not sent to other recipients – so it should not be there for me to see.

All of my software is fully up to date. I’ve checked and I can see the bcc info on another iPhone too when accessing my email account.

Can anyone explain what is happening please, and has anyone else experienced it…?

What smtp server are the affected messages sent through? Some years ago, outlook.com had a configuration issue causing bcc’d messages to be processed in such a way that the “hidden” addresses were moved to the “To” line.

Perhaps that bug has surfaced again or is affecting a different provider. IIRC, it wasn’t a mail client issue in that particular instance.

[WSVictor Delta]

jabeattyauditor wrote:

WSVictor Delta wrote:

Something very odd is happening and I can’t quite believe it!

I can access my emails via MS Outlook on my home pc and also my iPhone. Recently, I’ve noticed that I can see the bcc (blind carbon copy) addressees in full (ie names and email addresses) on some emails on my iPhone, although they appear correctly (ie without showing the bcc addresses) on MS Outlook.

I can hardly believe this is possible because, as I understand it, the bcc address info is not sent to other recipients – so it should not be there for me to see.

All of my software is fully up to date. I’ve checked and I can see the bcc info on another iPhone too when accessing my email account.

Can anyone explain what is happening please, and has anyone else experienced it…?

What smtp server are the affected messages sent through? Some years ago, outlook.com had a configuration issue causing bcc’d messages to be processed in such a way that the “hidden” addresses were moved to the “To” line.

Perhaps that bug has surfaced again or is affecting a different provider. IIRC, it wasn’t a mail client issue in that particular instance.

They are being sent via a Gmail account.

[mn–]

WSVictor Delta wrote:

They are being sent via a Gmail account.

mn– wrote:

Also should check if this holds for all versions or just some.

Well, I checked myself, sent two messages with Windows Mail v. 16005.12228.20206.0 (Windows 10 1909 18363.476) and a Gmail account, and didn’t get a visible bcc header to either direct or bcc recipient.

1 user thanked author for this post.

WSVictor Delta

[WSVictor Delta]

Thanks. And which iPhone did you receive the messages on…?

[Paul T]

The only guaranteed way for the BCC to remain hidden is for the email client to remove the BCC line from the DATA section of the message. Then any MTA can’t pass the information on.
Whatever client is being used to send the email is doing it wrong.

See the second answer in this discussion for some more info.

cheers, Paul

1 user thanked author for this post.

WSVictor Delta

[mn–]

Paul T wrote:

The only guaranteed way for the BCC to remain hidden is for the email client to remove the BCC line from the DATA section of the message. Then any MTA can’t pass the information on.

… and the only possible cases where it might not be a sender bug would involve gateways between modern Internet-based email and something completely different. Been a couple of decades since I last used such a thing.

(Actually on a quick rereading of RFC5322 it seems that it’s technically allowed to deliver a Bcc header to direct Bcc recipients, but only them. It’s only indirectly that this does make doing the right thing very difficult later on…)

Paul T wrote:

Whatever client is being used to send the email is doing it wrong.

So. I did a very quick check with what I believe should be the most recent general-release version of Windows 10 Mail, and didn’t see this bug.

I think we’d need either version information from where the problem was seen, or at least more testing with different versions.

[WSVictor Delta]

I’m trying to get more details and the exact version info etc from the sender.

• This reply was modified 4 months ago by WSVictor Delta.

[WSVictor Delta]

The person whose emails first drew my attention to this problem has been away but is now back. He writes:

The app I use is Windows 10 mail.

My current version is:  16005. 12228. 20276. 0

The last update = 26/11/2019

So a different version to the one tested by mn-

[Paul T]

Can he connect directly to his mail server via a browser and send an email from there? That will remove Windows mail from the equation.

cheers, Paul

[WSVictor Delta]

Paul T wrote:

Can he connect directly to his mail server via a browser and send an email from there? That will remove Windows mail from the equation.

cheers, Paul

He could but he doesn’t want to. The app is more convenient. Anyway, he shouldn’t have to, the app should work correctly.

[jabeattyauditor]

WSVictor Delta wrote:

Paul T wrote:

Can he connect directly to his mail server via a browser and send an email from there? That will remove Windows mail from the equation.

cheers, Paul

He could but he doesn’t want to. The app is more convenient. Anyway, he shouldn’t have to, the app should work correctly.

I believe Paul was suggesting that as a troubleshooting step – take the app out of the equation to be certain it’s the app causing the issue.

[WSVictor Delta]

jabeattyauditor wrote:

WSVictor Delta wrote:

Paul T wrote:

Can he connect directly to his mail server via a browser and send an email from there? That will remove Windows mail from the equation.

cheers, Paul

He could but he doesn’t want to. The app is more convenient. Anyway, he shouldn’t have to, the app should work correctly.

I believe Paul was suggesting that as a troubleshooting step – take the app out of the equation to be certain it’s the app causing the issue.

Thanks and apologies – I should have read Paul T’s post more carefully.

I will ask him to send me two similar emails, both containing bcc addresses, one from the W10 Mail app and the other by accessing Gmail via his browser. I’ll then post copies of the two, as they appear on my iPhone.

[WSVictor Delta]

Here we are. He sent me two emails – both addressed to 5 bcc email addresses – one from his Win 10 Mail app and one via the same Gmail account but using a browser.

The attached picture shows how the 2 mails appeared in MS Outlook and on my iPhone 6. Please note that even the browser email shows one bcc address but it is only for the receiving address ie it does not reveal any of the other addressees whereas the Win 10 Mail app email does.

Any thoughts…?

PS I have redacted the names etc for privacy reasons

Attachments:

You must be logged in to access attached files.

[Paul T]

Seems that W10 mail is leaving the BCC text in the header.
To check you need to view the raw / source / full text and check the headers for a BCC line – probably just after “Mime-Version”.

cheers, Paul

[WSVictor Delta]

Yes, I’ve had a look at the source code and can confirm the bcc addresses are all shown there in full, whereas on the browser email they are not.

I wonder is someone else with Win 10 Mail app version 16005. 12228. 20276. 0 can replicate the problem.

[PKCano]

Window built-in Apps are poor quality.
Change to a third-party email program for better results.

[joep517]

I just ran a brief test with Windows Mail Version 16005.12329.41000.0 and the BCC was not in the header for the TO or the BCC accounts when I examined the email in Outlook. No iPhone to test with but if it is not in the header I don’t know how it would appear.

Also, based on the comment by the OP that it happens on an iPhone 5 & 6 but not iPhone 8 the problem may lie in the Apple email program not interpreting something correctly on older iPhones.

--Joe

[mn–]

joep517 wrote:

Also, based on the comment by the OP that it happens on an iPhone 5 & 6 but not iPhone 8 the problem may lie in the Apple email program not interpreting something correctly on older iPhones.

Point is, this should not be possible. Either the Bcc data is in there in the raw message or it’s not, and it being there is the bug regardless of whether any given client displays it or not.

If it happens intermittently, that’s another thing.

[WSVictor Delta]

mn– wrote:

If it happens intermittently, that’s another thing.

In the case of the user who sent me the above emails, it happens every time he sends out emails including bcc addressees.

[Paul T]

I wonder if it’s a setting in W10 mail?

cheers, Paul

[WSVictor Delta]

Paul T wrote:

I wonder if it’s a setting in W10 mail?

Such as…?

[Paul T]

I don’t have W10 mail to wander through the settings.

cheers, Paul

[b]

This Microsoft Community thread and Feedback Hub problem report confirm that it’s the combination of sending from Windows 10 Mail with a Gmail account which incorrectly causes visible BCC recipients:

When I use Bcc in Mail on Windows 10 it doesn’t hide the addresses from the recipients

Failure in Windows 10 Mail App when using BCC from a GMail account

Windows 10 Pro Version 2004: Group ASAP (chump/pioneer)

2 users thanked author for this post.

WSVictor Delta, Kirsty

[WSVictor Delta]

b wrote:

This Microsoft Community thread and Feedback Hub problem report confirm that it’s the combination of sending from Windows 10 Mail with a Gmail account which incorrectly causes visible BCC recipients:

When I use Bcc in Mail on Windows 10 it doesn’t hide the addresses from the recipients

Failure in Windows 10 Mail App when using BCC from a GMail account

Many thanks for spotting that. I’ve just asked asked my friend to update his Mail app and will report back after another test email!

1 user thanked author for this post.

b

[WSVictor Delta]

This is really odd. My friend has updated his Mail app to the recently issued version –

16005.12228.20356.0 – but a test message sent this morning still contains all the bcc addresses in full (visible again on my iPhone 6).

Have asked him to reboot his pc in case that’s what’s needed to complete the installation…?

[Paul T]

This assumes MS have actually fixed the issue.

Has he reset the mail app per the first link posted by @b?

cheers, Paul

[WSVictor Delta]

Interestingly, the bug still exists and the mail app has not been appropriately updated by Microsoft yet.

I wonder how many people have already unwittingly breached GDPR because of this?

[anonymous]

I don’t know if this is relevant or not but it might pertain to testing.

Many years ago there was a mail client that if the email to be sent had a “To” address and a “bcc” address, all was well.  The bcc list stayed hidden.  However, if the “To” address was left blank and there was a bcc address or list, the bcc addresses would be shown to everyone.  Our solution was to enter the sender as the To address so it would not be blank.

2 users thanked author for this post.

WSVictor Delta, b

[b]

… and the samples at #2015054 show the To: left blank.

Including To: [self] could be a workaround for Windows 10 Mail BCC through Gmail.

Windows 10 Pro Version 2004: Group ASAP (chump/pioneer)

1 user thanked author for this post.

WSVictor Delta

[WSVictor Delta]

Many thanks for this spot of lateral thinking. Unfortunately, we have tried it and, with the current issue, adding a ‘To’ address does not prevent the bcc addresses being visible to all.

And, despite a couple of updates to the W10 Mail app, the bug has not yet been fixed.

• This reply was modified 1 month, 3 weeks ago by WSVictor Delta.

1 user thanked author for this post.

b

[Author]

Posts