To, Cc, Bcc and Reply-To

Module 3: Writing mail · Reading time: 11 minutes

Learning objective: After this lesson you can choose deliberately between To, Cc and Bcc for each recipient. You also know exactly what Reply all, Reply-To and forwarding do, and you can avoid leaking addresses.

Key concepts: To, Cc, Bcc, envelope, Reply all, Reply list, Reply-To, Followup-To, forward as attachment, data breach, daily limit

Three fields, three roles

When you write an email, you see one field for recipients by default. The plus sign next to it adds more. These fields aren't decoration: each one tells the recipient something about their role.

To is for people who need to act or who you expect a reply from. Put three people in To and all three feel responsible. Or none of them do, because each one thinks someone else will deal with it. So it's best to put one person in To, or say in your first sentence who does what.
Cc (carbon copy) is for people who are following along. Someone in Cc doesn't need to do anything but stays informed. All recipients can see who is in Cc.
Bcc (blind carbon copy) is for people who get a copy the others mustn't see. Anyone in Bcc is invisible to the recipients in To and Cc, and Bcc recipients can't see each other either.

How can Bcc be invisible when the email still reaches those people? It comes down to the difference between the envelope and the headers from lesson 1.1. The mail server delivers to the addresses on the envelope (RCPT TO). The To and Cc headers are just text in the message. With Bcc, your mail program does put the address on the envelope, but removes the Bcc header from the message the others receive. The standard for the message format (RFC 5322) describes exactly this behaviour.

Bcc and the GDPR: a visible address can be a data breach

An email address such as ahmed@example.net is personal data: it belongs to an identifiable person. If you send one email to forty customers and put them all in To or Cc, every customer gets the addresses of the thirty-nine others. They never agreed to that.

The GDPR calls this a personal data breach (article 4, point 12): a breach of security that leads to, among other things, unauthorised disclosure of personal data. In plain terms: a data breach. Whether you have to report it to the supervisory authority depends on the risk to the people involved (article 33). Forty addresses of a flower shop's customers is different from forty addresses of people in a debt support group: in the second case, just being on the list reveals something sensitive. If in doubt, record it and find out whether you need to report it. The Safe online course goes into this in more depth.

The rule is simple: if you email a group of people who don't (need to) know each other, put them in Bcc and put yourself in To. This also applies when you pick a group from your address book: the webmail then puts all the addresses in the field you're using.

A pitfall few people know about: a Bcc recipient who clicks Reply all gives themselves away. Their reply goes to everyone in To and Cc, who suddenly see that this person had a hidden copy. If you put someone in Bcc so they can follow along, tell them not to reply. If you want to involve someone openly, use Cc.

Replying: Reply, Reply all, Reply list

For a message you've received, you have three ways to reply.

Reply goes only to the sender (or to the address in Reply-To, see below).
Reply all goes to the sender and to everyone in To and Cc. Only use it if everyone else really needs your reply. "Thanks!" to twenty people is just noise.
Reply list (via the arrow next to Reply all) is for mail from a mailing list. List software adds a List-Post header to the message (RFC 2369), and the webmail then sends your reply to the list instead of to the person who wrote it.

Not sure whether to use Reply or Reply all? Check the To and Cc fields before you send. You can see exactly who will get it. Remove anyone who shouldn't be there.

Reply-To and Followup-To

With Reply-To (the Reply-To header) you're saying: I'd like replies to this email to go to a different address. For example, Emma sends an email about an order from emma@example.com, but wants replies to arrive at the shared address info@example.com so that Tom sees them too. She enters info@example.com under Reply-To. When the customer clicks Reply, info@ is already filled in as the recipient.

Reply-To is also a common trick used by scammers: the sender looks genuine, but your reply goes to a completely different domain (lesson 2.4). So now and then, check the address the webmail fills in when you reply.

Followup-To (the Mail-Followup-To header) comes from the world of mailing lists. It tells people where follow-up replies in a discussion should go, for example only to the list and not to you personally as well. Not every mail program does anything with it. In ordinary business mail you leave it empty.

Forwarding: inline or as attachment

With Forward you send a message you've received to someone else. The arrow next to it lets you choose how:

inline: the original message appears as a quote below your text. Handy for quickly bringing someone up to date. The recipient can read it as a normal email.
as attachment: the whole original message is included as an .eml file, with all its headers. You need this when someone has to see where an email really came from, for example when you forward phishing to a helpdesk.

When forwarding, pay attention to what's in the quote. A long thread often contains addresses, phone numbers or arrangements of people who don't know you're passing it on. Remove anything the new recipient doesn't need to see.

Many recipients: the daily limit

A mailbox is designed for personal email, not for newsletters. To prevent abuse, you can only send a limited number of emails per day. At WebOké this limit applies to your whole package combined: all mailboxes, the webmail and your website. Note: every recipient counts. One message with two hundred addresses in Bcc counts as two hundred emails. If you regularly want to reach a large group, use a newsletter service. It also handles unsubscribing and keeps your list tidy, which is what a newsletter needs. Other providers have similar limits.

Example: one email, three fields

Emma sends the quote for the wedding flowers to Ahmed.

To:   Ahmed <ahmed@example.net>
Cc:   Tom <tom@example.com>
Reply-To: info@example.com
Subject: Quote wedding flowers 14 June: please approve by 1 May

Ahmed has to approve, so he's in To. Tom makes the flowers and is following along: Cc. Ahmed can see that Tom is reading along, and that's fine, because Tom may call him later. Replies arrive at info@, which both Emma and Tom check.

In practice: how it works in the webmail

In Compose you'll find the To field. With the plus sign to the right of that field you add Cc, Bcc, Reply-To and Followup-To. The button with the little figures lets you pick contacts or a group from your address book. Above an opened message you'll find Reply, Reply all (with Reply list under the arrow) and Forward (with the choice of inline or as attachment). The steps are in the Roundcube manual. In other webmail, such as Gmail or Outlook.com, the buttons have almost the same names and work in a similar way.

The Compose screen with From, Recipient, Subject, the message text and the Send button — (1) From, (2) Recipient, (3) Subject, (4) your message, (5) Send

Summary

To is for people who need to act, Cc for people following along, Bcc for people who must stay invisible.
Bcc works via the envelope: the address receives the email, but the Bcc header isn't passed on to the others.
Visible addresses of people who don't know each other can be a data breach (GDPR article 4, point 12); whether you report it depends on the risk (article 33).
Use Reply all only if everyone needs your reply; a Bcc recipient who uses it gives themselves away.
Reply-To sends replies to a different address; every recipient counts towards the daily limit.

Quiz

Exercise

Exercise A3.1: Who goes where? Read the five situations and decide for each one whether the person or group mentioned belongs in To, Cc or Bcc. (1) Emma sends the quote for the wedding flowers and wants Ahmed to approve it: where does she put Ahmed? (2) In the same email, Emma wants Tom to know what was agreed; Tom doesn't need to do anything and Ahmed may see that Tom is reading along: where does she put Tom? (3) Emma emails forty customers who don't know each other to say the shop is closed on the May bank holiday: where does she put the customers? (4) Emma asks both the delivery service (planning@example.org) and Tom to confirm before Friday whether they can make it on Saturday; she expects a reply from both: where does she put the delivery service? (5) Emma replies to a customer's complaint and wants a copy in her own archive address archive@example.com; that address does nothing with the email and the customer doesn't need to see it: where does she put archive@example.com? For each situation you choose from the drop-down fields, and the program compares your answers with the key. For each situation you'll see whether your choice is right and why.

Cookies at WebOké

Cookie settings

Necessary

Marketing