Forwarding Email and BCC

[BobH]

The reports here in the Mail Delivery Failure thread of email addresses being hijacked and the reference to forwarding email as a bad practice caused me to look at my own practices and habits. I started a new thread to prevent hijacking.

I received a message this morning from a friend. I thought it amusing and thought of several other friends that might think so. I hit the "forward" button and selected all the addresses that showed up in the original message as received and deleted them; but, before doing so, I checked to be sure that there were no apparent attachments disclosed by Thunderbird. I then selected each address I wanted and right clicked to give me the tag options and chose "BCC" as I chose each address. Each appeared in the appropriate place in Thunderbird tagged as BCC addresses. I then clicked the send button and saw the email whisked off to my ISP's email server.

I then read the updated Mail Delivery Failure thread here and saw BigAl's comment about asking friends not to forward messages from him. This caused me to wonder what 'the man behind the curtain' did when I forwarded email; so I captured the message source as I received it with Notepad and did the same for the message source as it appears from my Sent folder.

In the message source as received, I could see what appear to be email addresses but could not tell if they identify prior senders or recipients that were in the original email received, but they seem to be encoded somehow - that is to say that they do not appear in the usual format of name@ISP_email_server_address. The DO appear after a tag, "Received: " making me believe that they are source email addresses which might be discernible; however I believe that they are addresses used only by the email servers at ISPs through which the message had passed - sort of like pointers decipherable only by the ISP as the packets move through (although, that is pure speculation on my part).

In the message source as sent, I looked for but DID NOT find those same contents which indicated to me that I had successfully removed those addresses or address pointers when I deleted them before sending. In fact, my sent message doesn't contain the "Received: " tag. I was surprised, however, to discover that the sent message contains a "BCC: " tag followed by the email addresses of the people I sent the message to.

(sorry to be so long-winded)

This led me to question whether or not this was a function of looking at the message source for an item from my Sent folder. I thought that the ISP's email server might use each BCC address in turn and strip off the others following the BCC tag. I tried another experiment this time sending the 'forwarded but cleansed of sender information' message to two other addresses used in our household but not otherwise used in my first experiment.

This time when I looked at the received message source in Notepad, there was NO BCC tag but the Received tag had returned with some presumably encoded address pointers. I believe that all of the Received tag information was added by the ISP and was not in the message as it left my computer. I have not yet determined whether any of the addresses/pointers are exactly the same as those from the original mail, but they might be.

So, what do you conclude from my results? Does anyone here have knowledge of how mail servers work and how they use the BCC and Received tags? Was I able to mask the identity of the person from whom I received the message?

[Bigaldoc]

It kinda sounds to me like you went the long way around.

In order to re-send a message in Thunderbird, while the message you received is in view, click on the command line at the top of your screen: Message, Edit Message as New.

If the original message has a lot of addressees, it IS a pain because you have to delete each one, one at a time, replacing them with those of your choosing. To prevent all from seeing the entire list, change the To: to a BCC:

That's why I try to encourage people to use BCC: to start with since it prevents everyone from seeing the entire list. For some reason, I must not know how to articulate my suggestion for I'm not very successful with it.

[BobH]

Hi BigAl!

You say toMAHto. I say toMAYto.

Seriously, my longwinded post was composed when my brain was not very agile - as is more and more frequently the case these days. Actually, what I do to messages before forwarding them is very simple and straightforward. While the message is displayed, I click the Forward button that appears to the right of the FROM address. This brings up the message in edit mode with a single click. I then select the addresses embedded in the message and delete them. Then, I select addresses from my address book by right-clicking them and choosing the Add_to_Bcc_Field option for the selected address which places it in the forwarded message. I almost never use the To option for addresses.

Your difficulties in convincing friends to strip out the addressing history are the same as mine. It seems I never can convince them until something happens to their address because someone left it in a forwarded message.

I hope someone who has been up their elbows in email client and server software will come along and explain how the tags embedded in messages are used (or how they should be used according to standard protocols). I've read the wiki here: http://en.wikipedia.org/wiki/Email_client but need to study much further to understand the protocols better.

Best regards . . .

[Argus]

In the message source as received, I could see what appear to be email addresses but could not tell if they identify prior senders or recipients that were in the original email received, but they seem to be encoded somehow - that is to say that they do not appear in the usual format of name@ISP_email_server_address. The DO appear after a tag, "Received: " making me believe that they are source email addresses which might be discernible; however I believe that they are addresses used only by the email servers at ISPs through which the message had passed - sort of like pointers decipherable only by the ISP as the packets move through (although, that is pure speculation on my part).

What you see, in the raw view of the mail, after the word "received" is the different MTAs (mail transfer agents) adding a little "stamp" to the header, a trace; it's not individuals, or even a MUAs, mail user agents, i.e. email clients, readers. The last one, or the first if reading from the top, and perhaps some of the earlier, ought to be related to your ESP (email service provider).

Since you linked to Wikip., here’s another one:
https://en.wikipedia.org/wiki/Message_transfer_agent" onclick="window.open(this.href);return false;

In the message source as sent, I looked for but DID NOT find those same contents which indicated to me that I had successfully removed those addresses or address pointers when I deleted them before sending. In fact, my sent message doesn't contain the "Received: " tag. I was surprised, however, to discover that the sent message contains a "BCC: " tag followed by the email addresses of the people I sent the message to.

No need to be surprised:
That is a local copy, you are looking at the "source", raw mail, of something meant to be sent, not something you have received; i.e. it hasn't been out and about on the net ... so no "post offices", MTAs, thus no "Received" in the headers. And thus, your instructions, BCC, should be there, informing the first MTA what do.

It's a copy, if I understand you correctly.

[Argus]

Just to add:
If you take a look at RFC 5321 - Simple Mail Transfer Protocol, you will find, among other:
4.4. Trace Information

When an SMTP server receives a message for delivery or further processing, it MUST insert trace ("time stamp" or "Received") information at the beginning of the message content, as discussed in Section 4.1.1.4.

http://tools.ietf.org/html/rfc5321#section-4.4" onclick="window.open(this.href);return false;

[BobH]

Thanks for information, Argus!!

The reference to the standard will help me to explore how the various software processes messages at each stage of its preparation and delivery. In this case, instead of ignoring "the man behind the curtain" I want to look behind the curtain and see what his software is doing.

Thank you again!