Date: Sun, 03 Nov 2019 20:56:45 -0500
From: "Valdis Kl=?utf-8?Q?=c4=93?=tnieks" <valdis.kletnieks@vt.edu>
Message-ID: <103064.1572832605@turing-police>
| I'll go further and assert that if there is still a Bcc: header in the
| RFC822 headers once the MSA has accepted the mail for further processing,
| that somebody has dropped the ball
Not always, sometimes there is only the Bcc header containing recipients.
At least one recipient field used to be required, when Bcc is the only one,
it had to be be retained (it didn't need to, and shouldn't, contain any
addresses, but the field had to remain). This requirement seems to have
been deleted, and now a message with no recipient fields is OK, but for
compat with older MUAs (potentially even MTAs) it is still a good idea to
include an empty Bcc: field when there are no To or Cc fields.
| because sometimes, even a Bcc: that shows that there *were*
| other recipients may be an unacceptable information leak....
When there is another recipient field, and this copy of the message
is to an address that is in that other field, that's reasonable. But when
the message is being delivered to someone on the Bcc list (which is all
the time when that was the only recipient field) there needs to be
something to explain to the recipient why the message was delivered to
them - a Bcc field ("one or more others received this message - you were
one of them") achieves that purpose, whether it contains the recipient's
address, or not.
kre