OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: Don't add domainname to 'To: Undisclosed-Recipient:;'
From: Liviu Daia (Liviu.Daiaimar.ro)
Date: Wed Jun 14 2000 - 08:43:48 CDT

On 14 June 2000, Brad Knowles <blkskynet.be> wrote:
> At 6:56 PM -0400 2000/6/13, Bennett Todd wrote:
>
> >> Make sure that the mail you send has either a "To" or "Cc" line in
> >> the headers.
> >
> > Or a "Bcc: " header, if you don't want anything wicked to this way
> > come at all.
>
> I believe that a valid "To:" and/or "Cc:" header is required,
> period. The presence or absence of a "Bcc:" header is immaterial.
> Therefore, you must stick something in there, even if it is
> effectively empty.
[...]

    According to RFC 822:

: C.3.4. DESTINATION
:
: A message must contain at least one destination address field.
: "To" and "CC" are required to contain at least one address.

--- where "destination" is defined as:

: destination = "To" ":" 1#address ; Primary
: / "Resent-To" ":" 1#address
: / "cc" ":" 1#address ; Secondary
: / "Resent-cc" ":" 1#address
: / "bcc" ":" #address ; Blind carbon
: / "Resent-bcc" ":" #address

    So apparently it's legal to have an empty "Bcc:". OTOH:

: 4.5.3. BCC / RESENT-BCC
:
: This field contains the identity of additional recipients of
: the message. The contents of this field are not included in
: copies of the message sent to the primary and secondary reci-
: pients. Some systems may choose to include the text of the
: "Bcc" field only in the author(s)'s copy, while others may
: also include it in the text sent to all those indicated in the
: "Bcc" list.

Now, since most MTAs (including Postfix) implement this by removing
"Bcc:" headers completely, an empty "Bcc:" won't get too far. This
basically means one must use "To:" or "Cc:", and _these_ can't be empty.

    Regards,

    Liviu Daia 

-- 
Dr. Liviu Daia               e-mail:   Liviu.Daiaimar.ro
Institute of Mathematics     web page: http://www.imar.ro/~daia
of the Romanian Academy      PGP key:  http://www.imar.ro/~daia/daia.asc