CODEWITHSUNDEEP
emailsmtpprotocols
Jelena
Jelena

Reputation: 486

In SMTP, must the RCPT TO: and TO: match?

When sending an email, the recipient list is given during the SMTP dialogue through RCTP TO: command. Later, in DATA command, header fields like 'To', 'Cc','bcc' are indicated. Does this RCPT TO list of recipients have to match with the headers indicated in DATA command?

Also, if the recipient is not indicated in RCPT TO, but in the To field of email header, is it going to be delivered to the recipient not in RCPT TO?

Upvotes: 33

Views: 43369

Answers (4)

Gustavo Fontinha
Gustavo Fontinha

Reputation: 59

Sharing a python code that implements this:

import smtplib
from email.mime.text import MIMEText
from email.mime.multipart import MIMEMultipart

def send_email():
    smtp_server = "smtpserver"
    port = 25

    rcpt = "rcpt_to@xxxx"
    msg = MIMEMultipart()
    msg["From"] = "no-replay@xxxxx"
    msg["To"] = "to@xxxxxx"
    msg["Subject"] = "Subject"

    body = "Body"
    msg.attach(MIMEText(body, "plain"))

    try:
        server = smtplib.SMTP(smtp_server, port)
        server.ehlo()
        server.sendmail(msg["From"], [rcpt], msg.as_string())
        server.quit()
        print("OK!")
    except Exception as e:
        print(f"Error: {e}")
send_email()

Upvotes: 0

silentser
silentser

Reputation: 2123

No, they don't have to match. When the message is sent, the SMTP Server (aka Mail Transfer Agent or MTA) is creating a so called SMTP envelope which contains the recipients and the sender of the message (see RFC5321):

SMTP transports a mail object. A mail object contains an envelope and content. The SMTP envelope is sent as a series of SMTP protocol units (described in Section 3). It consists of an originator address (to which error reports should be directed), one or more recipient addresses, and optional protocol extension material.

It is, actually, quite often that the RCPT TO: Command has more recipients that the header of the message - one common case is the usage of "blind copies" bcc: (see RFC5321):

Addresses that do not appear in the message header section may appear in the RCPT commands to an SMTP server for a number of reasons. The two most common involve the use of a mailing address as a "list exploder" (a single address that resolves into multiple addresses) and the appearance of "blind copies".

Upvotes: 25

james.garriss
james.garriss

Reputation: 13406

Does this RCPT TO list of recipients have to match with the headers indicated in DATA command?

Nope.

if the recipient is not indicated in RCPT TO, but in the To field of email header, is it going to be delivered to the recipient not in RCPT TO ?

The RCPT. Here's a (modified) transcript from my own SMTP client where I do just what you ask:

CLIENT: MAIL FROM:<[email protected]>
SERVER: 250 2.1.0 OK 
CLIENT: RCPT TO:<[email protected]>
SERVER: 250 2.1.5 OK 
CLIENT: DATA
SERVER: 354  Go ahead 
CLIENT: Subject: Test email
CLIENT: From:'John Doe'<[email protected]>
CLIENT: To:'John Doe'<[email protected]>
CLIENT: This is a test...
CLIENT: .

The message was successfully sent to "[email protected]".

Upvotes: 15

Hakan Serce
Hakan Serce

Reputation: 11256

SMTP protocol (RFC 2821) states the following:

When RFC 822 format [7, 32] is being used, the mail data include the
memo header items such as Date, Subject, To, Cc, From. Server SMTP
systems SHOULD NOT reject messages based on perceived defects in the
RFC 822 or MIME [12] message header or message body.

And this:

The DATA command can fail at only two points in the protocol exchange:

  • If there was no MAIL, or no RCPT, command, or all such commands were rejected, the server MAY return a "command out of sequence" (503) or "no valid recipients" (554) reply in response to the DATA command. If one of those replies (or any other 5yz reply) is received, the client MUST NOT send the message data; more generally, message data MUST NOT be sent unless a 354 reply is received.

From these statements, the headers and RCPT TO: command content does not have to match (altough they should match), and not using RCPT TO: MAY result in an error to prevent proceeding with DATA command.

Upvotes: 6

Related Questions