All 15 Email & Notifications questions
More in Email & Notifications
What is Nodemailer, and how does it let a Node.js application send emails via SMTP? Why should sending an email typically happen in a background job rather than synchronously within an HTTP request handler? How would you send a push notification from a Node.js backend to a mobile app using Firebase Cloud Messaging (FCM)? What is email template rendering, and how might you use a templating engine to generate dynamic HTML emails in Node.js? What is the difference between transactional email and marketing email, and why do most Node.js applications use separate providers or sending domains for each? What is an unsubscribe mechanism, and what specific requirements does it need to meet for compliance with regulations like CAN-SPAM? What is the difference between sending SMS via a provider's REST API (like Twilio) versus using SMTP-based email in terms of a Node.js integration? How would you test that a Node.js application correctly sends emails without actually sending real emails during automated tests? What are SPF, DKIM, and DMARC, and why do they matter for a Node.js application's transactional emails actually reaching users' inboxes? How would you design a multi-channel notification system in Node.js that can send the same logical notification via email, SMS, or push depending on user preference?
Advertisement
Node.js › Email & Notifications

What is the difference between the 'to', 'cc', and 'bcc' fields when sending an email programmatically, and why does 'bcc' matter for privacy?

Beginner

Answer

'to' and 'cc' (carbon copy) recipients are visible to every other recipient of the email, while 'bcc' (blind carbon copy) recipients receive the email without their address being visible to anyone else on the message -- this matters significantly when sending the same email to a list of unrelated users, where using 'to' or 'cc' for the whole list would expose every recipient's email address to every other recipient, a privacy mistake often made by accident.
// Privacy risk: every recipient sees everyone else's email address
await transporter.sendMail({ to: allUserEmails.join(','), subject: 'Update' });

// Better for a shared announcement to unrelated users
await transporter.sendMail({ to: 'noreply@example.com', bcc: allUserEmails.join(','), subject: 'Update' });
Real-world example A company accidentally exposed the email addresses of hundreds of newsletter subscribers by putting them all in the 'to' field of a single email instead of 'bcc', a mistake corrected in their process by always using bcc for bulk sends to unrelated recipients going forward.

Common follow-ups: In what legitimate scenario would you actually want to use 'cc' rather than 'bcc' or 'to' alone?;How do bulk email providers like SendGrid handle sending personalized emails to many recipients without this to/bcc pitfall at all?

Security;HTTP & HTTPS Modules
All 15 Email & Notifications questions