In SMTP, must the RCPT TO: and TO: match?

问题:

When sending an email, the recipient list is given during the SMTP dialogue through RCTP TO: command. Later, in DATA command, header fields like 'To', 'Cc','bcc' are indicated. Does this RCPT TO list of recipients have to match with the headers indicated in DATA command?

Also, if the recipient is not indicated in RCPT TO, but in the To field of email header, is it going to be delivered to the recipient not in RCPT TO?

回答1:

No, they don't have to match. When the message is sent, the SMTP Server (aka Message Transfer Agent or MTA) is creating a so called SMTP envelope which contains the recipients and the sender of the message (see RFC5321):

SMTP transports a mail object. A mail object contains an envelope and content. The SMTP envelope is sent as a series of SMTP protocol units (described in Section 3). It consists of an originator address (to which error reports should be directed), one or more recipient addresses, and optional protocol extension material.

It is, actually, quite often that the RCPT TO: Command has more recipients that the header of the message - one common case is the usage of "blind copies" bcc: (see RFC5321):

Addresses that do not appear in the message header section may appear in the RCPT commands to an SMTP server for a number of reasons. The two most common involve the use of a mailing address as a "list exploder" (a single address that resolves into multiple addresses) and the appearance of "blind copies".

回答2:

Does this RCPT TO list of recipients have to match with the headers indicated in DATA command?

Nope.

if the recipient is not indicated in RCPT TO, but in the To field of email header, is it going to be delivered to the recipient not in RCPT TO ?

The RCPT. Here's a (modified) transcript from my own SMTP client where I do just what you ask:

CLIENT: MAIL FROM:<[e-mail]>
SERVER: 250 2.1.0 OK 
CLIENT: RCPT TO:<[e-mail]>
SERVER: 250 2.1.5 OK 
CLIENT: DATA
SERVER: 354  Go ahead 
CLIENT: Subject: Test email
CLIENT: From:'John Doe'<[e-mail]>
CLIENT: To:'John Doe'<[e-mail]>
CLIENT: This is a test...
CLIENT: .

The message was successfully sent to "[e-mail]".

回答3:

SMTP protocol (RFC 2821) states the following:

When RFC 822 format [7, 32] is being used, the mail data include the
memo header items such as Date, Subject, To, Cc, From. Server SMTP
systems SHOULD NOT reject messages based on perceived defects in the
RFC 822 or MIME [12] message header or message body.

And this:

The DATA command can fail at only two points in the protocol exchange:

• If there was no MAIL, or no RCPT, command, or all such commands were rejected, the server MAY return a "command out of sequence" (503) or "no valid recipients" (554) reply in response to the DATA command. If one of those replies (or any other 5yz reply) is received, the client MUST NOT send the message data; more generally, message data MUST NOT be sent unless a 354 reply is received.

From these statements, the headers and RCPT TO: command content does not have to match (altough they should match), and not using RCPT TO: MAY result in an error to prevent proceeding with DATA command.