[2005] Email addresses in BCC visible to all

[MrGTI]

I am trying to send an email to a few people, and want to keep their email addresses private from one another. I enter their addresses into the BCC field, but when the email is sent, the email clearly shows everyones email address! (ie: BCC is not blind)

Any ideas why it's doing this? All of my test emails come back with the TO line full of every email address i added to the BCC field! Here's the code:

Dim msg As New System.Net.Mail.MailMessage
Dim smtp As New System.Net.Mail.SmtpClient

With msg
    .From = New System.Net.Mail.MailAddress("from@email_address.com")

    .Bcc.Add(New System.Net.Mail.MailAddress("to_person1@email_address.com"))
    .Bcc.Add(New System.Net.Mail.MailAddress("another_person@email_address.com"))

    .Subject = "my email subject"
    .IsBodyHtml = False
    .Body = "my email body"
    .Headers.Add("Importance", "Normal")
End With

With smtp
    .Host = "MY_EMAIL_SERVER"

    .Send(msg)
End With

[dbasnett]

you mean that when you go to one of the recipients they can see the bcc addresses?

[dbasnett]

A quick search shows you are not alone

http://www.google.com/search?hl=en&r...+address+shown

[MrGTI]

Yes, that is my problem. Each recipient can see all others.

I've been reading through some of the others posts (most were ones i had previously read while trying to figure out why it's doing this), but i haven't found a solution yet.

[RobDog888]

I dont believe there is an easy solution as all a receipient needs to do is click "Reply All" and even the bcc receipients will become visible.

[dbasnett]

RobD, That is not how it is supposed to work.

[RobDog888]

No its not supossed to be that way. Design flaw or um "feature" I guess.

[techgnome]

I've never had that happen to me....

-tg

[RobDog888]

Maybe its only in a certain version of Outlook perhaps. I havent noticed it since being on 2007 so far.

[dbasnett]

It is server / client specific.
"Addresses that do not appear in the message headers may appear in the
RCPT commands to an SMTP server for a number of reasons. The two
most common involve the use of a mailing address as a "list exploder"
(a single address that resolves into multiple addresses) and the
appearance of "blind copies". Especially when more than one RCPT
command is present, and in order to avoid defeating some of the
purpose of these mechanisms, SMTP clients and servers SHOULD NOT copy
the full set of RCPT command arguments into the headers, either as
part of trace headers or as informational or private-extension
headers. Since this rule is often violated in practice, and cannot
be enforced, sending SMTP systems that are aware of "bcc" use MAY
find it helpful to send each blind copy as a separate message
transaction containing only a single RCPT command."

[MrGTI]

At this point, i think this is a real bug/design flaw with the class by Microsoft.

I have .NET Framework version 2.0.50727 (which is SP1).

[MrGTI]

I can send an email from Outlook to 3 people in the BCC line and it works fine (using the same mail server). It only fails when i send it via code (and not through Outlook).

As a test, i will try to send it from another machine with a newer version of Office (i have Office 2002, but can test on an Office 2003 machine).

[dbasnett]

I just tried it in 3.5 and I did not see the bcc. I also looked at the internet header in outlook and did not see it there.

[MrGTI]

I don't have the .NET Framework 3.5, or the VS2008 IDE, so i can't test we that. The app was built in .NET 2.0, and staff machines are set up with that framework, so upgrading to 3.5 for everyone is a big step for a bug.

As far as i can see now, all of the testing points to a flaw in the .NET 2.0 code. But i find it strange i'm the first person discover this.

[Jenner]

You're probably not the first to discover it, but I don't expect too many people are programatically sending BCC emails. Most typical email applications people program send out a standard email to inform a remote user of some event.

There's a way to get around it though... you can fudge it. Make your program send an independent copy of the email to each individual BCC recipient maybe with an attached (You are a BCC recipient. This message was originally sent to the following people:... ) Ugly, sure, but it's either that or upgrade.

[techgnome]

(You are a BCC recipient. This message was originally sent to the following people:... )

That kinda defeats the purpose of a BCC... the point of a BCC is that the recipients don't know who else got it.

-tg

[Jenner]

That kinda defeats the purpose of a BCC... the point of a BCC is that the recipients don't know who else got it.

-tg

Maybe my explanation isn't clear:

They fill out an email, going to MainRecipient, CC'd to CCUser1 and CCUser2 and BCC's to BCCUser1 and BCCUser2. User hits "SEND"

This is what the program now does:

Send an email to MainRecipient with a CC to CCUser1, CCUser2. This message has no BCC recipients.

Send a copy of the email to BCCUser1 as the primary recipient. This message has no CC or BCC recipients. Include in the body: "You are a BCC Recipient, this message was originally sent to MainRecipient and CC'd to CCUser1, CCUser2."

Send a copy of the email to BCCUser2 as the primary recipient. This message has no CC or BCC recipients. Include in the body: "You are a BCC Recipient, this message was originally sent to MainRecipient and CC'd to CCUser1, CCUser2."

It does this because a BCC recipient can still see who the original recipient was and who it was CC'd to.

[MrGTI]

I get what you're suggesting Jenner, however it would work for us. The people on the BCC list for us are students, so we need to keep them private.

At this point i have 2 solutions:

1) turn my mass email into a loop that emails each person. (which defeats the purpose of sending a mass email, but will work, even if it does take longer to run, and put a greater load on the email server)

2) revert back to the System.Web.Mail.MailMessage class used in 1.1. I only switched to System.Net.Mail.MailMessage because VS2005 shows a "warning" that the Web one is obsolete (it still works and compiles fine)

[Jenner]

Personally, I'd try to convince your IT department to push the 3.5 .NET framework to the client computers. If your IT infrastructure is set up correctly, this shouldn't be an issue at all and take seconds to set up.

Next best solution, use the 1.1 class until the above happens. Then you can easily switch to the 3.5 class with an update.

[MrGTI]

I am IT

And yes, it's the best solution. However,... things never get done that quickly. It always seems like it only takes a few minutes to do it, but there's always a bunch of reasons why it can't be rolled out yet, so you get bogged down with those issues. It will happen,.... just not as fast as i'd like. (I'm sure you understand)

I will continue with the 1.1 code until i can test this in 3.5. It sure would have been nice to have a solution to the bug in 2.0.

[dbasnett]

If you have the ability to capture packets i.e. Sniffer, capture them both ways and see what the difference is.