[GH-ISSUE #35] Any way to see info on BCC?

kerem commented

2026-03-15 12:12:49 +03:00

Owner

Originally created by @titantwentyone on GitHub (Feb 16, 2023).
Original GitHub issue: https://github.com/axllent/mailpit/issues/35

Really unsure if this is possible but it would be great if we can confirm who is in the BCC field. When the email is received in Mailpit, the headers (correctly) won't show this. The Mailpit API shows a field for "BCC" which always is empty when I check. I have tests (Laravel project) to confirm the presence of a BCC recipient but no way to verify again with a concrete example using Mailpit.

Thank for your work on Mailpit!

Originally created by @titantwentyone on GitHub (Feb 16, 2023). Original GitHub issue: https://github.com/axllent/mailpit/issues/35 Really unsure if this is possible but it would be great if we can confirm who is in the BCC field. When the email is received in Mailpit, the headers (correctly) won't show this. The Mailpit API shows a field for "BCC" which always is empty when I check. I have tests (Laravel project) to confirm the presence of a BCC recipient but no way to verify again with a concrete example using Mailpit. Thank for your work on Mailpit!

kerem closed this issue

2026-03-15 12:12:54 +03:00

kerem commented

2026-03-15 12:13:00 +03:00

Author

Owner

@axllent commented on GitHub (Feb 17, 2023):

@titantwentyone I must admit that I haven't tested this (BCC) in an actual sending/receiving situation, but rather injecting existing emails from my harddrive directly into Mailpit (which does contain BCC data within the headers of sent emails, not received). I know that received emails do not include BCC headers - else it would be easily possible to see all BCC recipients when an email is received (defeating the whole point of BCC). What I really need to confirm is whether SMTP receives the BCC recipients as an email header, or whether it simply gets sent a separate copy of the email for each BCC recipient.

I really need to investigate this much more before I can give you a better answer, but unfortunately the area I live in has been without power after a cyclone hit us early in the week, so this will take a while longer to resolve (or provide a definitive answer to your question).

@axllent commented on GitHub (Feb 17, 2023): @titantwentyone I must admit that I haven't tested this (BCC) in an actual sending/receiving situation, but rather injecting existing emails from my harddrive directly into Mailpit (which does contain BCC data within the headers of **sent** emails, not received). I know that received emails do not include BCC headers - else it would be easily possible to see all BCC recipients when an email is received (defeating the whole point of BCC). What I really need to confirm is whether SMTP receives the BCC recipients as an email header, or whether it simply gets sent a separate copy of the email for each BCC recipient. I really need to investigate this much more before I can give you a better answer, but unfortunately the area I live in has been without power after a cyclone hit us early in the week, so this will take a while longer to resolve (or provide a definitive answer to your question).

kerem commented

2026-03-15 12:13:05 +03:00

Author

Owner

@axllent commented on GitHub (Feb 18, 2023):

@titantwentyone I have tested here (different PHP framework) in an environment with PHP's config is using sendmail_path = /usr/local/bin/mailpit sendmail and can confirm the full headers are received, including Bcc.

Received: from localhost (localhost [127.0.0.1])
        by 782459e19800 (Mailpit) with SMTP
        for <sendmail>; Sat, 18 Feb 2023 17:14:32 +1300 (NZDT)
To: info@example.com
Subject: Test subject
Message-ID: <68df7ae062dc2ba17be927fe9346e1ff@gaze.sdev>
Date: Sat, 18 Feb 2023 17:14:32 +1300
From: website@example.com
Cc: cc@example.com
Bcc: bcc@example.com
MIME-Version: 1.0
Content-Type: multipart/alternative;
 boundary="_=_swift_1676693672_3fa666fa97c6c484f05d1cbea2849151_=_"
X-Priority: 3 (Normal)

This is shown correctly within Mailpit.

Can you please confirm how your environment however is set up, specifically how you are routing mail to Mailpit?

@axllent commented on GitHub (Feb 18, 2023): @titantwentyone I have tested here (different PHP framework) in an environment with PHP's config is using `sendmail_path = /usr/local/bin/mailpit sendmail` and can confirm the full headers are received, _including_ Bcc. ``` Received: from localhost (localhost [127.0.0.1]) by 782459e19800 (Mailpit) with SMTP for <sendmail>; Sat, 18 Feb 2023 17:14:32 +1300 (NZDT) To: info@example.com Subject: Test subject Message-ID: <68df7ae062dc2ba17be927fe9346e1ff@gaze.sdev> Date: Sat, 18 Feb 2023 17:14:32 +1300 From: website@example.com Cc: cc@example.com Bcc: bcc@example.com MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="_=_swift_1676693672_3fa666fa97c6c484f05d1cbea2849151_=_" X-Priority: 3 (Normal) ``` This is shown correctly within Mailpit. Can you please confirm how your environment however is set up, specifically how you are routing mail to Mailpit?

kerem commented

2026-03-15 12:13:10 +03:00

Author

Owner

@titantwentyone commented on GitHub (Mar 11, 2023):

Sorry for the delay. I am going to look into this in the next few days. A cursory look seemed to indicate a false positive in one of my tests so I apologize if this is indeed the case. Will confirm shortly. Just for info, Mailpit is used within a Laravel app.

@titantwentyone commented on GitHub (Mar 11, 2023): Sorry for the delay. I am going to look into this in the next few days. A cursory look seemed to indicate a false positive in one of my tests so I apologize if this is indeed the case. Will confirm shortly. Just for info, Mailpit is used within a Laravel app.

kerem commented

2026-03-15 12:13:15 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Apr 4, 2023):

This issue is stale because it has been open for 21 days with no activity.

@github-actions[bot] commented on GitHub (Apr 4, 2023): This issue is stale because it has been open for 21 days with no activity.

kerem commented

2026-03-15 12:13:20 +03:00

Author

Owner

@sklr commented on GitHub (Apr 6, 2023):

I'm using Laravel 8.77 with Mailpit running on 127.0.0.1:1025. With Laravel's Mail::send() method I set 'to', 'cc' and 'bcc'.
I see 'to' and 'cc' in the headers, but no 'bcc'.
To be fair, I was expecting it as a separate message addressed to the 'bcc' address.

@sklr commented on GitHub (Apr 6, 2023): I'm using Laravel 8.77 with Mailpit running on 127.0.0.1:1025. With Laravel's Mail::send() method I set 'to', 'cc' and 'bcc'. I see 'to' and 'cc' in the headers, but no 'bcc'. To be fair, I was expecting it as a separate message addressed to the 'bcc' address.

kerem commented

2026-03-15 12:13:25 +03:00

Author

Owner

@axllent commented on GitHub (Apr 6, 2023):

This is interesting, and I can't see at a quick glance exactly how Laravel 8 handles mail internally , but there are a few points here worth noting. Firstly there are many different sendmail clients, and they all work slightly differently as they are all just similar implementations (which is why so many have ignored flags to try maintain compatibility). Likewise with Mailpit's version, it has a single goal - just to pass the email through to the Mailpit SMTP server.

According to courier IMAP's implementation of sendmail:

If at least one E-mail address is specified on the command line, sendmail delivers the message to those recipients only. If no addresses are specified on the command line, sendmail reads the message and builds the recipient list from the To:, Cc: and Bcc: headers.

Normally, if no recipients are specified, sendmail obtains the list of recipients by reading the To:, Cc: and Bcc: headers (Bcc: headers are then removed).

My guess here is that Laravel will send the email via sendmail, not add any BCC headers, and simply provide an array of all addresses it needs to go to via the command-line, effectively telling the SMTP server "here is the raw message.... and these are the recipients" (so ignore the raw email headers). Other PHP implementations appear to not provide any email addresses via the commandline, and just populate the raw email headers accordingly.

A regular SMTP server would send these messages on, sending a separate email per recipient to the destination server / mailbox, and add a Delivered-To header for each email telling the remote server who to actually send it to. It also removes any BCC headers from the original email. As I understand it, Gmail for instance will inject a new BCC header if the Delivered-To doesn't appear in the list of recipients when the email is received.

The important distinction here is that Mailpit does not send anything on (there is an open issue requesting this, but it is complicated for the same reasons), so the message stops here and is not modified.

Mailpit will not remove, edit or add any headers (as this would defeat the point), and Mailpit's ignores all separate addresses supplied by sendmail to it, as the whole point of it to capture the email in its original form. Creating a separate duplicate email within Mailpit for any command-line added BCC supplied would be useless.

So I am really not sure how to deal with your issue. One potential solution is I could try parse any emails provided to Mailpit's sendmail and inject them as BCC headers (if they don't already exist in To, Cc or Bcc). This wouldn't work of course if the user is using a system-installed ("regular") sendmail to do this though.

Are you able to gain any further insight as to exactly how Laravel 8 sends mail via sendmail? What I am curious about is the actual sendmail command that is run as the email is sent, and specifically whether all recipients are passed via the command-line?

@axllent commented on GitHub (Apr 6, 2023): This is interesting, and I can't see at a quick glance exactly how Laravel 8 handles mail internally , but there are a few points here worth noting. Firstly there are many different `sendmail` clients, and they all work slightly differently as they are all just similar implementations (which is why so many have ignored flags to try maintain compatibility). Likewise with Mailpit's version, it has a single goal - just to pass the email through to the Mailpit SMTP server. According to courier IMAP's implementation of sendmail: > If at least one E-mail address is specified on the command line, sendmail delivers the message to those recipients only. If no addresses are specified on the command line, sendmail reads the message and builds the recipient list from the To:, Cc: and Bcc: headers. > Normally, if no recipients are specified, sendmail obtains the list of recipients by reading the To:, Cc: and Bcc: headers (Bcc: headers are then removed). My guess here is that Laravel will send the email via sendmail, not add any BCC headers, and simply provide an array of all addresses it needs to go to via the command-line, effectively telling the SMTP server "here is the raw message.... and these are the recipients" (so ignore the raw email headers). Other PHP implementations appear to not provide any email addresses via the commandline, and just populate the raw email headers accordingly. A regular SMTP server would send these messages on, sending a separate email per recipient to the destination server / mailbox, and add a `Delivered-To` header for each email telling the remote server who to actually send it to. It also removes any BCC headers from the original email. As I understand it, Gmail for instance will inject a new BCC header if the `Delivered-To` doesn't appear in the list of recipients when the email is received. The **important distinction** here is that Mailpit does not send anything on (there is an [open issue](#29 ) requesting this, but it is complicated for the same reasons), so the message stops here and is not modified. Mailpit will not remove, edit or add any headers (as this would defeat the point), and Mailpit's ignores all separate addresses supplied by sendmail to it, as the whole point of it to capture the email in its original form. Creating a separate duplicate email within Mailpit for any command-line added BCC supplied would be useless. So I am really not sure how to deal with your issue. One potential solution is I could try parse any emails provided to Mailpit's sendmail and inject them as BCC headers (if they don't already exist in To, Cc or Bcc). This wouldn't work of course if the user is using a system-installed ("regular") sendmail to do this though. Are you able to gain any further insight as to exactly how Laravel 8 sends mail via sendmail? What I am curious about is the actual sendmail command that is run as the email is sent, and specifically whether all recipients are passed via the command-line?

kerem commented

2026-03-15 12:13:30 +03:00

Author

Owner

@axllent commented on GitHub (Apr 14, 2023):

Today I have done a fair bit of investigation (I'm new to Laravel). From what I can tell, your Laravel environment (.env) is is configured to send using smtp (default). This means the emails are delivered directly to the SMTP server (ie: Mailpit), and not passed through a MTA such as sendmail.

When sending directly to a SMTP server, Laravel does not include the Bcc header in the email, but rather provides a list of email addresses in the SMTP request instead. If however (and I'm not saying this works in your environment) the mail is set to use sendmail, it does include the Bcc in the email headers - I'm not sure whether sendmail adds them, or Laravel, but that is irrelevant here. Sendmail in turns forwards the email on as-is which includes the Bcc headers. I guess it could be a security feature in Laravel, I'm not entirely sure.

The issue here however is that Mailpit stores the email it receives "as-is" (only adding a single "received" header), and it is this email that is then parsed in the web UI . There is no record of the Bcc address(es) if they aren't included in the original headers. The only way to store that data is to either append to existing Bcc headers (if they exist), or add new ones.

I am currently working on adding this functionality into Mailpit, which should solve your issue by adding the "missing" Bcc field to the email when it is received.

@axllent commented on GitHub (Apr 14, 2023): Today I have done a fair bit of investigation (I'm new to Laravel). From what I can tell, your Laravel environment (`.env`) is is configured to send using `smtp` (default). This means the emails are delivered directly to the SMTP server (ie: Mailpit), and not passed through a MTA such as sendmail. When sending directly to a SMTP server, Laravel does not include the Bcc header in the email, but rather provides a list of email addresses in the SMTP request instead. If however (and I'm not saying this works in your environment) the mail is set to use sendmail, it **does** include the Bcc in the email headers - I'm not sure whether sendmail adds them, or Laravel, but that is irrelevant here. Sendmail in turns forwards the email on as-is which includes the Bcc headers. I guess it could be a security feature in Laravel, I'm not entirely sure. The issue here however is that Mailpit stores the email it receives "as-is" (only adding a single "received" header), and it is this email that is then parsed in the web UI . There is no record of the Bcc address(es) if they aren't included in the original headers. The only way to store that data is to either append to existing Bcc headers (if they exist), or add new ones. I am currently working on adding this functionality into Mailpit, which should solve your issue by adding the "missing" Bcc field to the email when it is received.

kerem referenced this issue

2026-03-15 14:17:28 +03:00

[PR #32] [MERGED] Added kubernetes liveness and readiness probes #410

Rows
Columns

[GH-ISSUE #35] Any way to see info on BCC? #32