Why am I able to see bcc addressees…?

[WSVictor Delta]

Something very odd is happening and I can’t quite believe it!

I can access my emails via MS Outlook on my home pc and also my iPhone. Recently, I’ve noticed that I can see the bcc (blind carbon copy) addressees in full (ie names and email addresses) on some emails on my iPhone, although they appear correctly (ie without showing the bcc addresses) on MS Outlook.

I can hardly believe this is possible because, as I understand it, the bcc address info is not sent to other recipients – so it should not be there for me to see.

All of my software is fully up to date. I’ve checked and I can see the bcc info on another iPhone too when accessing my email account.

Can anyone explain what is happening please, and has anyone else experienced it…?

1 user thanked author for this post.

Michael Austin

[mn–]

WSVictor Delta wrote:

although they appear correctly (ie without showing the bcc addresses) on MS Outlook.

That’s normally a sender-side application bug. Those came up once every few years in some application or another. The initial SMTP sending application is supposed to generate a recipient listing and at that time drop the bcc line from header data.

Some mail relay servers have also been known to strip a Bcc header from mails, but the SMTP spec doesn’t require them to.

Outlook has been known to, among other things, hide bcc fields in received mail. I’m told this is a “Feature”(tm). Features such as this are the main reason why I tell newbie mail server admins to not use Outlook with any mailbox on their servers… it hides technical things they need to see for their admin work. In this case, hiding someone else’s bug.

2 users thanked author for this post.

Michael Austin, WSVictor Delta

[WSVictor Delta]

Thanks for that. The emails I’ve noticed this on came from someone using the Windows 10 Mail app…!

1 user thanked author for this post.

Michael Austin

[Nathan Parker]

Is this using the Mail app on iPhone or the Outlook app on iPhone?

Nathan Parker

1 user thanked author for this post.

Michael Austin

[WSVictor Delta]

Nathan Parker wrote:

Is this using the Mail app on iPhone or the Outlook app on iPhone?

I’m using the standard, built-in, Mail app on my iPhone.

1 user thanked author for this post.

Michael Austin

[WSVictor Delta]

Mine is an iPhone 6. My wife’s iPhone 5 gives the same result.

However, a friend’s iPhone 8 doesn’t show the bcc addresses on the same emails.

All are using the latest software available.

• This reply was modified 1 year ago by WSVictor Delta.

1 user thanked author for this post.

Michael Austin

[Paul T]

This just means the BCC info was left in by the sending mail program / server and some mail clients choose not to show it.

cheers, Paul

1 user thanked author for this post.

Michael Austin

[WSVictor Delta]

Paul T wrote:

This just means the BCC info was left in by the sending mail program / server and some mail clients choose not to show it.

cheers, Paul

Yes, but it’s pretty poor of the Windows 10 Mail app to do this as it could cause the sender to unwittingly breach GDPR.

When you send an email with bcc addressees, you don’t expect them to be visible to some recipients.

• This reply was modified 1 year ago by WSVictor Delta.

1 user thanked author for this post.

Michael Austin

[mn–]

WSVictor Delta wrote:

When you send an email with bcc addressees, you don’t expect them to be visible to some recipients.

… according to https://answers.microsoft.com/en-us/windows/forum/all/win-10-mail-not-showing-bcc-of-my-sent-emails/a2ee10d8-6fcf-43ad-8aa4-2ab76c04b49e they’re not visible to sender. As in can’t check the bcc field of sent (archived) messages. Recipients still get them…?

Really feels like someone might have very severely misunderstood what the bcc is supposed to do.

Right. Don’t use Windows 10 Mail for anything. Also should check if this holds for all versions or just some.

[jabeattyauditor]

WSVictor Delta wrote:

Something very odd is happening and I can’t quite believe it!

I can access my emails via MS Outlook on my home pc and also my iPhone. Recently, I’ve noticed that I can see the bcc (blind carbon copy) addressees in full (ie names and email addresses) on some emails on my iPhone, although they appear correctly (ie without showing the bcc addresses) on MS Outlook.

I can hardly believe this is possible because, as I understand it, the bcc address info is not sent to other recipients – so it should not be there for me to see.

All of my software is fully up to date. I’ve checked and I can see the bcc info on another iPhone too when accessing my email account.

Can anyone explain what is happening please, and has anyone else experienced it…?

What smtp server are the affected messages sent through? Some years ago, outlook.com had a configuration issue causing bcc’d messages to be processed in such a way that the “hidden” addresses were moved to the “To” line.

Perhaps that bug has surfaced again or is affecting a different provider. IIRC, it wasn’t a mail client issue in that particular instance.

[WSVictor Delta]

jabeattyauditor wrote:

WSVictor Delta wrote:

Something very odd is happening and I can’t quite believe it!

I can access my emails via MS Outlook on my home pc and also my iPhone. Recently, I’ve noticed that I can see the bcc (blind carbon copy) addressees in full (ie names and email addresses) on some emails on my iPhone, although they appear correctly (ie without showing the bcc addresses) on MS Outlook.

I can hardly believe this is possible because, as I understand it, the bcc address info is not sent to other recipients – so it should not be there for me to see.

All of my software is fully up to date. I’ve checked and I can see the bcc info on another iPhone too when accessing my email account.

Can anyone explain what is happening please, and has anyone else experienced it…?

What smtp server are the affected messages sent through? Some years ago, outlook.com had a configuration issue causing bcc’d messages to be processed in such a way that the “hidden” addresses were moved to the “To” line.

Perhaps that bug has surfaced again or is affecting a different provider. IIRC, it wasn’t a mail client issue in that particular instance.

They are being sent via a Gmail account.

[mn–]

WSVictor Delta wrote:

They are being sent via a Gmail account.

mn– wrote:

Also should check if this holds for all versions or just some.

Well, I checked myself, sent two messages with Windows Mail v. 16005.12228.20206.0 (Windows 10 1909 18363.476) and a Gmail account, and didn’t get a visible bcc header to either direct or bcc recipient.

1 user thanked author for this post.

WSVictor Delta

[WSVictor Delta]

Thanks. And which iPhone did you receive the messages on…?

[Paul T]

The only guaranteed way for the BCC to remain hidden is for the email client to remove the BCC line from the DATA section of the message. Then any MTA can’t pass the information on.
Whatever client is being used to send the email is doing it wrong.

See the second answer in this discussion for some more info.

cheers, Paul

1 user thanked author for this post.

WSVictor Delta

[mn–]

Paul T wrote:

The only guaranteed way for the BCC to remain hidden is for the email client to remove the BCC line from the DATA section of the message. Then any MTA can’t pass the information on.

… and the only possible cases where it might not be a sender bug would involve gateways between modern Internet-based email and something completely different. Been a couple of decades since I last used such a thing.

(Actually on a quick rereading of RFC5322 it seems that it’s technically allowed to deliver a Bcc header to direct Bcc recipients, but only them. It’s only indirectly that this does make doing the right thing very difficult later on…)

Paul T wrote:

Whatever client is being used to send the email is doing it wrong.

So. I did a very quick check with what I believe should be the most recent general-release version of Windows 10 Mail, and didn’t see this bug.

I think we’d need either version information from where the problem was seen, or at least more testing with different versions.

[WSVictor Delta]

I’m trying to get more details and the exact version info etc from the sender.

• This reply was modified 1 year ago by WSVictor Delta.

[WSVictor Delta]

The person whose emails first drew my attention to this problem has been away but is now back. He writes:

The app I use is Windows 10 mail.

My current version is:  16005. 12228. 20276. 0

The last update = 26/11/2019

So a different version to the one tested by mn-

[Paul T]

Can he connect directly to his mail server via a browser and send an email from there? That will remove Windows mail from the equation.

cheers, Paul

[WSVictor Delta]

Paul T wrote:

Can he connect directly to his mail server via a browser and send an email from there? That will remove Windows mail from the equation.

cheers, Paul

He could but he doesn’t want to. The app is more convenient. Anyway, he shouldn’t have to, the app should work correctly.

[jabeattyauditor]

WSVictor Delta wrote:

Paul T wrote:

Can he connect directly to his mail server via a browser and send an email from there? That will remove Windows mail from the equation.

cheers, Paul

He could but he doesn’t want to. The app is more convenient. Anyway, he shouldn’t have to, the app should work correctly.

I believe Paul was suggesting that as a troubleshooting step – take the app out of the equation to be certain it’s the app causing the issue.

[WSVictor Delta]

jabeattyauditor wrote:

WSVictor Delta wrote:

Paul T wrote:

Can he connect directly to his mail server via a browser and send an email from there? That will remove Windows mail from the equation.

cheers, Paul

He could but he doesn’t want to. The app is more convenient. Anyway, he shouldn’t have to, the app should work correctly.

I believe Paul was suggesting that as a troubleshooting step – take the app out of the equation to be certain it’s the app causing the issue.

Thanks and apologies – I should have read Paul T’s post more carefully.

I will ask him to send me two similar emails, both containing bcc addresses, one from the W10 Mail app and the other by accessing Gmail via his browser. I’ll then post copies of the two, as they appear on my iPhone.

[WSVictor Delta]

Here we are. He sent me two emails – both addressed to 5 bcc email addresses – one from his Win 10 Mail app and one via the same Gmail account but using a browser.

The attached picture shows how the 2 mails appeared in MS Outlook and on my iPhone 6. Please note that even the browser email shows one bcc address but it is only for the receiving address ie it does not reveal any of the other addressees whereas the Win 10 Mail app email does.

Any thoughts…?

PS I have redacted the names etc for privacy reasons

Attachments:

You must be logged in to access attached files.

[Paul T]

Seems that W10 mail is leaving the BCC text in the header.
To check you need to view the raw / source / full text and check the headers for a BCC line – probably just after “Mime-Version”.

cheers, Paul

[WSVictor Delta]

Yes, I’ve had a look at the source code and can confirm the bcc addresses are all shown there in full, whereas on the browser email they are not.

I wonder is someone else with Win 10 Mail app version 16005. 12228. 20276. 0 can replicate the problem.

[PKCano]

Window built-in Apps are poor quality.
Change to a third-party email program for better results.

[joep517]

I just ran a brief test with Windows Mail Version 16005.12329.41000.0 and the BCC was not in the header for the TO or the BCC accounts when I examined the email in Outlook. No iPhone to test with but if it is not in the header I don’t know how it would appear.

Also, based on the comment by the OP that it happens on an iPhone 5 & 6 but not iPhone 8 the problem may lie in the Apple email program not interpreting something correctly on older iPhones.

--Joe

[mn–]

joep517 wrote:

Also, based on the comment by the OP that it happens on an iPhone 5 & 6 but not iPhone 8 the problem may lie in the Apple email program not interpreting something correctly on older iPhones.

Point is, this should not be possible. Either the Bcc data is in there in the raw message or it’s not, and it being there is the bug regardless of whether any given client displays it or not.

If it happens intermittently, that’s another thing.

[WSVictor Delta]

mn– wrote:

If it happens intermittently, that’s another thing.

In the case of the user who sent me the above emails, it happens every time he sends out emails including bcc addressees.

[Paul T]

I wonder if it’s a setting in W10 mail?

cheers, Paul

[WSVictor Delta]

Paul T wrote:

I wonder if it’s a setting in W10 mail?

Such as…?

[Paul T]

I don’t have W10 mail to wander through the settings.

cheers, Paul

[b]

This Microsoft Community thread and Feedback Hub problem report confirm that it’s the combination of sending from Windows 10 Mail with a Gmail account which incorrectly causes visible BCC recipients:

When I use Bcc in Mail on Windows 10 it doesn’t hide the addresses from the recipients

Failure in Windows 10 Mail App when using BCC from a GMail account

3 users thanked author for this post.

Elly, WSVictor Delta, Kirsty

[WSVictor Delta]

b wrote:

This Microsoft Community thread and Feedback Hub problem report confirm that it’s the combination of sending from Windows 10 Mail with a Gmail account which incorrectly causes visible BCC recipients:

When I use Bcc in Mail on Windows 10 it doesn’t hide the addresses from the recipients

Failure in Windows 10 Mail App when using BCC from a GMail account

Many thanks for spotting that. I’ve just asked asked my friend to update his Mail app and will report back after another test email!

1 user thanked author for this post.

b

[WSVictor Delta]

This is really odd. My friend has updated his Mail app to the recently issued version –

16005.12228.20356.0 – but a test message sent this morning still contains all the bcc addresses in full (visible again on my iPhone 6).

Have asked him to reboot his pc in case that’s what’s needed to complete the installation…?

[Paul T]

This assumes MS have actually fixed the issue.

Has he reset the mail app per the first link posted by @b?

cheers, Paul

[WSVictor Delta]

Interestingly, the bug still exists and the mail app has not been appropriately updated by Microsoft yet.

I wonder how many people have already unwittingly breached GDPR because of this?

[anonymous]

I don’t know if this is relevant or not but it might pertain to testing.

Many years ago there was a mail client that if the email to be sent had a “To” address and a “bcc” address, all was well.  The bcc list stayed hidden.  However, if the “To” address was left blank and there was a bcc address or list, the bcc addresses would be shown to everyone.  Our solution was to enter the sender as the To address so it would not be blank.

2 users thanked author for this post.

WSVictor Delta, b

[b]

… and the samples at #2015054 show the To: left blank.

Including To: [self] could be a workaround for Windows 10 Mail BCC through Gmail.

1 user thanked author for this post.

WSVictor Delta

[WSVictor Delta]

Many thanks for this spot of lateral thinking. Unfortunately, we have tried it and, with the current issue, adding a ‘To’ address does not prevent the bcc addresses being visible to all.

And, despite a couple of updates to the W10 Mail app, the bug has not yet been fixed.

• This reply was modified 10 months ago by WSVictor Delta.

1 user thanked author for this post.

b

[WSVictor Delta]

Good news at last!

Whilst an email from my friend (using Windows Mail and Gmail) on Thursday morning (2 Apr 20) revealed all the bcc addresses as usual, his emails from Saturday onwards have not.

I myself received an update for Windows Mail on Thursday (to version 16005.12624.20368.0) so I assume this has finally fixed the bug.

I’m surprised it took Microsoft nearly 6 months to fix this issue (given the serious GDPR implications) but am glad they have finally done so now.

3 users thanked author for this post.

b, Paul T, Elly

[anonymous]

Hello.  We have just experienced this exact issue, emailing from mail.google.com to a group of BCC’d recipients. I am emailing from a domain that is mapped to a gmail account.

Any idea what has caused this? I read something about enabling IMAP which I have done, but that doesn’t seem to make a difference?

Thank you! I am worried about this as we’re a small company and this is a GDPR breach which I’m not sure how to address!

PJ

[mn–]

Well, this is a sending application issue. You need to determine what application is used to send the mail, specific server or address may not be relevant.

IMAP doesn’t do anything when you send mail, directly. Sending protocol is SMTP, and the application is supposed to omit other BCC recipients from headers in the SMTP DATA part. Any “BCC” text in the message body (quoted or whatever) is untouched, it is the user’s responsibility to mind what they send in the body. Also the body content has no direct bearing on who the message may be delivered to.

It appears to be allowed but not required to keep a BCC line that holds only a single recipient address when that is the same single address that this particular copy of the message is being delivered to. (Forwarding will likely then preserve that.) If your sending application is the official Gmail (web interface or maybe Gmail dedicated application on phones etc), this would be the documented behaviour.

This can be a problem if you aren’t careful when replying to a mail from your own sent mail folder. After all, there is no requirement to strip BCC from your own archived copy… because that would sort of invalidate it as a record of “what did I send to whom”, wouldn’t it?

[Author]

Posts