Is there a way to send email where receiver sees multiple recipient email addresses includes his, but in fact only send to one receiver himself?
2 Answers
Absolutely. During the sending phase you need to only talk to the MX server of the recipient and only specify them in the RCPT command. But I know of no MUA that can do so.
- 114,604
Yes, it is always possible to have the SMTP recipient list completely different from the "To:" or "Cc:" headers; the servers don't really care about the headers.
For example, that's how "Bcc:" addressing works (as there is no "Bcc:" header at all), but it can also go the other way and include headers that have nothing to do with the real recipient list.
In a SMTP conversation, it would look like this:
$ nc mailserver.example.net smtp ← 220 mailserver.example.net ESMTP Hello! → ehlo yourhostname.isp.net ← 250 mailserver.example.net → mail from:<KMC@nonexistent.org> ← 250 OK → rcpt to:<real-recipient@example.net> ← 250 OK → rcpt to:<another-recipient@example.net> ← 250 OK → data ← 354 Waiting for data → To: <fake-recipient@example.net>, <someone@else.tld> → Subject: Hello there. → Content-Type: text/plain; charset=utf-8 → → The thing about email is that you can spoof practically everything. → . ← 250 OK → quit ← 221 Bye
The addresses given in the envelope – rcpt – are the actual recipients. They will receive the message.
The addresses given in the header – To: – are only for display purposes. They are not used for sending.
When using the Unix sendmail interface, the same rule applies except the recipients are given in the command line:
$ sendmail real-recipient@example.net → To: <fake-recipient@example.net>, <someone@else.tld> → Subject: Hello there. → Content-Type: text/plain; charset=utf-8 → → One thing about email is that you can spoof practically everything. → CtrlD
- 501,077