This digs down further into the mechanics of SMTP.
At server level, there is an "envelope" that contains all the addresses,
including To:, Cc: and Bcc:. This envelope is created at the time the
message is submitted to the server Mail Transport Agent (MTA), and stays
in place only until the message has been accepted by the receiving
server, and then the envelope is discarded.
The MTA will insert To: and Cc: (but not Bcc:) into the headers of the
message content, but all of that is incidental to what is happening in
the envelope.
Dating back to the days of when RFC 821 was the governing standard, it's
possible to telnet into port 25 of SMTP server, and pass the server raw
SMTP commands, creating your own envelope. Working from memory, the
general form is:
HELO
something.com
MAIL FROM:
sen...@whatever.com
RCPT TO:
y...@example.com
DATA
In this, the sending server identifies itself to the receiver with a
HELO, identifies the purported server with MAIL FROM:, but the key for
delivery is what is put in RCPT TO:. That's what tells the receiving
server the true recipient address(es).
For DATA, what is submitted after that (and not shown here) is the
entire contents of the message, both headers and body -- that is
*everything* you see in a Thunderbird inbox, if you press CTRL-U to show
the raw content of the message. The transmission is completed when the
server sends a hard return (CRLF) followed by a dot, followed by another
hard return.
On servers that I have admin access to, I occasionally will do this, as
a demonstration of how the mechanics of SMTP work, including the
difference between envelope and content, and how easy it is to forge any
or all of the message contents.
Basically, once you get to the DATA command, you can put in anything at
all, and the contents don't have to be don't have to be compliant with
RFC-822 (and successor standards). Thus, for what follows the data
command, I can paste in anything I want, including pasting in the entire
raw content of another message.
In that raw content, I can put To: or Cc: lines, which may or may not
correspond to your address, as well as putting whatever From: line that
I want.
This is stuff commonly done by spammers, as a way of trying to hide
their tracks.
Thus, if I have necessary server access, I can forge almost any content
into the message that reaches your inbox, including purporting to send
as
bill....@microsoft.com or
pres...@whitehouse.gov, even if I don't
have access to those servers.
Moving back to the "undisclosed-recipients;" question, that's what's
used by a lot of mail clients (outgoing) to ensure that the message has
a To: line (with some content), even if all addressees are specified
with Bcc:. For the purposes of delivery and envelope handling, it
doesn't make any difference what is put there. "To:
undisclosed-recipients;" is there to tell the recipient that the entire
list of addressees was specified by Bcc:.
That said, how individual servers handle such addressing will vary,
usually as a part of spam handling. Some may reject messages where the
raw content has identical addresses for To: and From:. Others may
reject (or throttle) messages where the envelopes have more than a
certain number of addresses in the envelope (that is, RCPT TO).
This is why, if you're doing bulk-mailing, you want to be doing it
through a server that's designed for doing bulk mailing, rather than
just sending batches of messages with big To:, Cc: or Bcc: distribution
lists. With a bulk mail server, there's a lot more control for
recipients to opt in and opt out of mailings, but when messages are
sent, each addressee gets a message with a separate envelope, rather
than the sending server trying to stuff all the addressees with the same
domain into a single envelope. Plus, with bulk mail servers, messages
are sent with a Priority: header set to "Bulk" or "Low".
But I digress...
Smith