Closed Bug 1279558 Opened 8 years ago Closed 8 years ago

The BCC option is being ignored and mails are sent as To (only using the Outlook.com SMTP server)

Categories

(Thunderbird :: Message Compose Window, defect)

Product:
Thunderbird
Component:
Message Compose Window
Version:
45 Branch
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

(Not tracked)

Status:
RESOLVED INVALID

People

(Reporter: bransons, Unassigned)

References

Details

(Keywords: privacy) 

User Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
Build ID: 20160604131506

Steps to reproduce:

I sent a mail to a large number of recipients, each recipient had a seperate mail address line and every one was changed to Bcc. 
I tried again with a short list of recipients and the problem was the same.



Actual results:

TB ignored this and revealed every Email address to every recipient. I'm in big trouble.


Expected results:

Normal Bcc behaviour showing no Email addresses
Tested with (only) two addresses just now. Works just fine to me. 
Make sure you try it again with all add-ons disabled (Help | Restart with add-ons disabled)
I don't get it. Go easy on me, I'm a neophite in this stuff. I also genereated a new Email and sent it having changed the To to Bcc and, like you it worked fine. It appears to be related to the particular Email with the large mail list (about 70 recipients). I just forwarded my 'Sent' copy to four Email addresses (changed to Bcc before sending) and it showed all other recipients. Wierd but not good.
I could send you the troublesome Email if that helps?
Sure, save as .eml the mail from your Sent folder, and send it to me.
Component: Security → Message Compose Window
Keywords: privacy
Magnus, did you receive the Email?
Yes, but no clues to what happened.
It has the header

To: undisclosed-recipients:;, and then a bunch of addresses

Hmm, now looking more closely it does have a Received:  header too, so the mail you sent me is apparently NOT from the Sent folder?
Please let me pass along some of my findings for problems I have been encountering when using a desktop email client and sending through SMTP server at Outlook.com:

1. When I do not have an email address in the “To” field, do not have an email address in the “Cc” field, do put a single email address or a group list into the Bcc field, and send the email from my “Thunderbird” email desktop client through my outgoing SMTP server at "Outlook.com", the email goes through "Outlook.com" and "Outlook.com" moves all the email addresses from the “Bcc” field to the “To” field (All my email addresses used to stay in the “Bcc” field as they should until about four weeks ago).

2. When I put an email address in the "To" field, another email address in the "Cc" field and two more email addresses in the "Bcc" field, and send the email from my “Thunderbird” email desktop client through my outgoing SMTP server at "Outlook.com", the result is that the email addresses used in the "To" and "Cc" fields received emails from me and the email addresses used in the "Bcc" field never received my emails when I send from my SMTP server at Outlook.com.

I tried:
•	Using names in the To, Cc, Bcc fields.
•	Using email addresses in the To, Cc, Bcc fields.
•	Using Postbox as my desktop email client to send the emails.
•	Using Thunderbird as my desktop email client to send the emails.
•	Using "Gmail" for my outgoing SMTP server instead of “Outlook.com” – There were NO problems as shown in problem # 1 and #2 above, and all recipients received their emails as they should have.
•	Using “Outlook Mail” on the web with my browser to create my emails and send them instead of using my desktop email client - There were NO problems as shown in problem # 1 and #2 above, and all recipients received their emails as they should have.
•	Creating a new alias account to see if that changed anything - it didn't.
•	Using incoming imap-mail.live.com and outgoing smtp-mail.live.com servers as one MS web site suggested regarding the new changes to Outlook Mail but those new setting would not connect.
•	Using incoming outlook.office365.com and outgoing smtp.office365.com servers as suggested regarding the new changes to Outlook Mail but those new setting would not connect.
•	Looking at the full message header of the email residing in the Outlook “Sent” folder based on the input fields I mentioned in problem #2 above, and found that NO Bcc addresses were sent from the SMTP Outllook.com server. 

Conclusions:
1. Ron Sommer, a MVP Community Moderator who answered me about this problem on the MS forum, told me, “After further test, it appears that the Office 365 server will not send Bcc emails if you send using an email program. If you login using a browser, Bcc emails can be sent.”

2. Based on all of the above, I believe the “Outlook.com” server is not picking up the “Bcc” email addresses from a desktop email client and handling them properly because everything works as it should if I use a web browser to send my emails or I send my emails from a desktop email client using any SMTP except “Outlook.com”.

3. Maybe the problem isn't with Thunderbird. Maybe it is with the SMTP server at Outlook.com

I hope this adds some insight to a possibility.
Thx Laurel, do you have a link to that forum answer?

Clive, I assume you're also using the outlook.com smtp?
Summary: The BCC option is being ignored and mails are sent as To. → The BCC option is being ignored and mails are sent as To (only using the Outlook.com SMTP server)
I do appear to be using the outlook.com smtp.
The TB pull down seems to offer me 'hotmail' (same as outlook?) and Gmail.
I have no idea what this is. Assume I know nothing and you won't be far wrong.
You're not doing anything wrong, but apparently the outlook server has a bug that is causing the problem. Nothing really we can do about that :(
Magnus:

Here is a link to the post I mentioned.

http://answers.microsoft.com/en-us/outlook_com/forum/opeople-ocontacts/outlookcom-moving-addresses-from-bcc-field-to-the/b4505d03-7b66-4f98-a878-f1d82fcf42a6

If you or others reading this have any pull with MS to fix the problem, it would be helpful if you used your influence to speed up a resolution.
Thanks for input Jorg K and Laurel Valley. Apologies that I didn't find this bug report to add my comments so started another (I did look but can't have used the right terms to find it). I concur completely with Laurel having done my own testing that this is a Microsoft server issue as Thunderbird behaves just as it should when sending messages through servers other than Microsoft's. It used to work fine with MS servers until about the last week in June which seems to match the timing of the MS changes. I have added a more full response to the Microsoft link noted in Laurel's post above.
Since there are two known problems/bugs (shown in Comment #6 above) with the way Bcc is now handled because of the new API changes the Microsoft giant made to Outlook.com, would anyone speculate or know:
1. Should Mozilla Thunderbird be enhanced to process addresses in the outgoing Bcc field so the new API for the Microsoft Outlook.com server will accept the Bcc addresses from Thunderbird and send emails to those addresses correctly, or
2. That this is a blatant violation of email protocol and Microsoft technical support personnel should implement a solution on their end?
It's pretty clearly #2.
Obviously if sufficient pressure can be applied to MS this is the correct result. However, I have been in this type of situation in my business life and... TB will lose members when they discover the BCC issue. The members will not care who is at fault or even where the issue resides. Unfortunately, the chances are that MS will have little interest in repairing their code in the short term. Answer is probably for TB to make the temporary fix, remove it when MS finally fix it properly and make a big deal of saying 'I TOLD YOU SO'.
Can you check the value of the preference mail.compose.add_undisclosed_recipients (in options->advanced->config editor)?
user set  boolean  false
whatever that means!
Well, it should be set to true (the default). Then TB automatically inputs a "undisclosed-recipients" as the To: field if only BCC addresses are input by the user.

Maybe then the server will not try to be too clever (or stupid, it could add the "undisclosed-recipients" too...).
Fairly certain I have never changed the default. Wouldn't know how to or why I should.
Should I? and, if so, how?
Right-click the pref and choose Reset. It should switch to 'true'.

Maybe somebody told you far in the past to change it to 'false' as the MS server didn't work with 'true'. Or somebody did it for you so you do not remember :)
I've read through these reports, but I can't really interpret what is going on from a protocol perspective. Is this well known?

Reading comment 0 and assuming it correctly describes observed behavior, I'm assuming there is behavior like this:

SMTP is sent a command:

RCPT TO:<alice@example.com>

where alice@example.com is not present in either the To: or Cc: headers of the sent email. MS SMTP sends the message to alice, but then adds her email address to the To: header of the email to all recipients.

Is that an accurate description of what is going on? If so, this is a massive privacy violation by Microsoft.

It would be really useful if someone could figure out if this is an intentional change by Microsoft, and if so where that is documented.

If intentional, the only reasonable response we could make would be to add code that fails sending messages to a MS SMTP server if the message contains a BCC recipient.
I hope this helps.

Bcc problem situations when testing and using desktop email client programs (eM Client, Mailbird, Postbox, and Thunderbird) and sending IMAP outgoing email through the SMTP server at Outlook.com:

1. When I do not have an email address in the “To” field, do not have an email address in the “Cc” field, do put a single email address or a group list into the Bcc field, and send the email from an email desktop client program above through my outgoing SMTP server at "Outlook.com", the email goes through "Outlook.com" and "Outlook.com" moves all the email addresses from the “Bcc” field to the “To” field.

2. When I put an email address in the "To" field, another email address in the "Cc" field and two more email addresses in the "Bcc" field, and send the email from an email desktop client program above through my outgoing SMTP server at "Outlook.com", the result is that the email addresses used in the "To" and "Cc" fields receive emails from me and the email addresses used in the "Bcc" field never receive my emails when I send from my SMTP server at “Outlook.com”.

Notes:

a. My Outlook web page has shown “Outlook Mail” in the top left corner instead of “Outlook.com” for many weeks. All my email addresses used to stay in the “Bcc” field as they should until my Microsoft account was changed from Outlook.com to Outlook Mail.

b. I am using IMAP, and incoming imap-mail.outlook.com Port 993 and outgoing smtp-mail.outlook.com Port 587 for my Outlook.com server being used in the email client programs shown above. 

c. I checked the value of the preference mail.compose.add_undisclosed_recipients (in options->advanced->config editor) in both Thunderbird and Postbox. Both programs have the preference set to “true”.

d. When I test the two Bcc problem situations mentioned above using all the email desktop client programs above through the IMAP outgoing SMTP server at Outlook.com, the Bcc addresses do NOT process properly.

e. When I test the two Bcc problem situations mentioned above using all the email desktop client program above through IMAP outgoing SMTP servers at Centurylink.net and Gmail.com, the Bcc addresses process properly.

f. When I test the two Bcc problem situations mentioned above using the Windows 10 Mail App, the Bcc addresses process properly. The email that was received from the problem situation #2 above showed “(no recipient)” in the TO field and the email address I specified in the Bcc field.

g. When I test the two Bcc problem situations mentioned above using mail through web browsers at Outlook, Gmail, and CenturyLink, the Bcc addresses process properly.

Conclusions:

1. The two Bcc processing problems shown above only happen when specifically sending IMAP outgoing mail through the SMTP server at Outlook.com, and using any desktop email program other than the Windows 10 Mail App.

2. It seems very apparent to me, based on the testing and results shown above, that Microsoft made some email API changes to the SMTP Outlook.com server that impact Bcc processing by email client programs that are not affiliated with Microsoft.
Laurel, your symptoms are clear, but not expressed in protocol terms. I'll just assume though that the obvious interpretation in protocol terms from my comment 21 is correct.

If so, then by normal rules of how we handle things, this bug would be marked "invalid" as it is not our problem.

But let's assume that this change was intentional, probably as a result of misuse of smtp.outlook.com by spam providers. It would be great if this could be confirmed, and I see from internet postings that people are trying to do that. If and when there is an official confirmation, please post that to this bug.

Rather than mark this bug as invalid, perhaps we could morph it into the question, what should Thunderbird do in response (if anything)? One option as I said before would be to add some new ability to detect use of BCC to non-conforming servers, and refuse to send that email.
I finally found a solution in a thread posted on eM Client that resolves the two problems mentioned above. After implementing the solution in my test eM Client, I could send emails to Bcc addresses using situations 1 and 2 above, and those addresses received the emails properly.

The solution is that if a person’s Microsoft Outlook.com account shows “Outlook Mail” in the upper left corner instead of “Outlook.com”, then the desktop email program should set up the account as an Exchange based account so Bcc emails will be sent properly. The person’s email address and User name should BOTH contain the person’s email address. 

1. I couldn’t figure out a way to set up an Exchange account through Outlook.com in Thunderbird to test it here. Is there a way to do that and if so, how?
It would appear that there is nothing wrong with Thunderbird. The source of this problem is MS Outlook itself. Please go to Microsoft Forum:

http://answers.microsoft.com/en-us/outlook_com/forum/opeople-ocontacts/outlookcom-moving-addresses-from-bcc-field-to-the/b4505d03-7b66-4f98-a878-f1d82fcf42a6?page=1

and find on p. 3 the following response from Sean Stevenson - Outlook.com Email Transport Team, dated October 2, 2016:

"Hi all,
Thank you for reporting this issue Laurel. We have been able to reproduce this issue and have identified the problem on our side. We are actively working on a solution. I will respond to this thread when the solution has been deployed and confirm that you see the problem solved from your end. We will also look at how this issue could have been escalated sooner.
Regards,
Sean
Outlook.com Email Transport team"

Now, let's see how long it will take MS to correct this major deficiency in their Outlook email system!
Thanks for the update, bullseye10x. It seems like it is time to mark this bug as INVALID since my comment 23 no longer applies.
Status: UNCONFIRMED → RESOLVED
Closed: 8 years ago
Resolution: --- → INVALID
You need to log in before you can comment on or make changes to this bug.