Changes coming to the SMTP Authenticated Submission client protocol

Deleted

Sep 20, 2018

We run an application that relays email via Exchange Online over SMTP. One of the features of this application is the ability to track emails on a per-recipient basis, even for grouped emails. For example, if an end-user sends an email with 2 email addresses in the TO field and 1 email address on the CC field, this application, it will report when each of the 3 recipients has opened the email.

To do this, it leverages the decoupling between the SMTP envelope and data. It connects to smtp.office365.com:587 and issue 3 send-email transactions. Each transaction includes ONLY 1 of the recipients in the "RCPT TO" command. The data field contains identical headers across all 3 email are identical. In the example above, they all contain the 2 email addresses 'To' header and the 1 email address in the 'Cc' header. However, the message body will include a unique image URL.

This application has worked flawlessly over the past 3+ years allowing us to implement fine-grained email-open tracking.

However, over the past few days, there seems to be a change email where multiple emails are being delivered by Exchange. Each recipient in the email is getting the email where their email address is in the RCPT command AND every email for all other recipients as well! It appears as though Exchange is delivering emails to every email address mentioned in the RCPT command AND in the To and CC headers.

Consider the following SMTP transcript:

---------------------------begin------------------

MAIL FROM: sender@example.com

RCPT TO: user1@example.com

DATA

To: user1@example.com

Cc: user2@example.com

Subject: test email

test 1

MAIL FROM: sender@example.com

RCPT TO: user2@example.com

DATA