Search for BCC

MailDepot Query - Why is it sometimes possible to get a result for BCC Recipient queries in mails, and sometimes not?

From time to time, we are asked why sometimes E-Mails can be found with a BCC E-Mail address query and sometimes not.
We want to focus on this topic and explain what the BCC Field is and why in theory it should not exist anyway.
After that, we will explain in what constellations it is possible to search for that field, while in the majority it is not.

E-Mails are required to follow a certain technical and identical structure, so they can be sent, received and displayed worldwide.
The following is a Quote from RFC-2822 regarding the BCC-Field in an E-Mail Header (https://datatracker.ietf.org/doc/html/rfc2822).

The "Bcc:" field (where the "Bcc" means "Blind Carbon Copy") contains addresses of recipients of the message whose addresses are not to be revealed to other recipients of the message.
There are three ways in which the "Bcc:" field is used.

  1. In the first case, when a message containing a "Bcc:" field is prepared to be sent, the "Bcc:" line is removed even though all of the recipients (including those specified in the "Bcc:" field) are sent a copy of the message.
  2. In the second case, recipients specified in the "To:" and "Cc:" lines each are sent a copy of the message with the "Bcc:" line removed as above, but the recipients on the "Bcc:" line get a separate copy of the message containing a "Bcc:" line.
    (When there are multiple recipient addresses in the "Bcc:" field, some implementations actually send a separate copy of the message to each recipient with a "Bcc:" containing only the address of that particular recipient.)
  3. Finally, since a "Bcc:" field may contain no addresses, a "Bcc:" field can be sent without any addresses indicating to the recipients that blind copies were sent to someone.

Which method to use with "Bcc:" fields is implementation dependent

A Recipient listed in the BCC Field receives an E-Mail without the address being visible to other recipients.
To Achieve this, the BCC line will be removed from the E-Mail header completeley, before transmission.
Even the BCC recipients do not see that they have been addressed in the BCC-Field, while also not listed in TO- or CC-Field.
It is not possible to determine, if (and if yes, to whom) this E-Mail was sent in BCC.

Basically, the transmission of an E-Mail is like sending a regular letter.
That is, the letter and the transmission (postman/postwoman) to the recipient.

When you write two letters to the same address, but ask the postman/postwomen to deliver the letters to two different mailboxes, you will have the same described effect:

The Letter has only one address, but is delivered to two addresses while not visible on the letter.
That is the same case with E-Mails.

For E-Mails, the transmission via SMTP (Simple Mail Transfer Protocol) is the postman/postwomen.
The recipients are listed in the Envelope-To part of the SMTP (Simple Mail Transfer Protocol) and can be delivered correctly that way.

In the E-Mail, the BCC recipient is not shown in the same time.
As we - to continue with our example - archive the letter, and not the postman/postwomen, the BCC-Field does not have any addresses and cannot be queried for.

The important part of that question is, if the BCC-Field existed on the time of archiving or not.
Usually, the BCC-Field is removed by the sending mail server.
When archiving takes place in kind of a SMTP-Gateway, the BCC-Information is not present in the E-Mail anymore, when it reaches the REDDOXX MailDepot.

When using Microsoft Exchange Journaling, chances are that the BCC-Field still has content.
Our tests have shown, that Microsoft Exchange moves a copy of the original E-Mail to the journal mailbox before removing the BCC-Field and sending the E-Mail.
At the time of archiving via the journal mailobx, the BCC information is available and will be archived accordingly (and can be searched for).

Disclaimer: If you can search for addresses in BCC-Field in your specific infrastructure cannot be guaranteed by us.
It depends on how your mail server implemented the usage of BCC-Fields.
Furthermore the explanation is only to be considered for out going E-Mails.

For incoming E-Mails, the BCC-Field was removed from the sending Mail server and does not exist anymore when the incoming E-Mail is archived in the REDDOXX MailDepot.