Search code examples
phpemailphpmailerprivacybcc

Is it a good idea to trust BCC to not reveal other people's addresses?


I'm using PHPMailer to send emails with SMTP from my script. The emails in question are actually cell numbers utilizing email-to-SMS gateways. Now, ideally I want to build up a big BCC list to send everything in one batch instead of looping through a big list of addresses and sending them one at a time.

Should I completely trust BCC functionality to hide other recipient's addresses (which in this case are mostly phone numbers)?


Solution

  • A number of MTAs will respond to a broken To field by dumping all the BCC addresses into an "Apparently-To" header---not what you want. Sounds like you'd benefit from reading up on SMTP: there are two places where To addresses are set, and they need not be the same. Set the envelope address to what you need, and the data To address to some convenient gibberish.