Salesforce Email CC and BCC: The Complete Guide to Recipient Copying, Compliance, and CRM Logging

This glossary covers every CC and BCC behaviour—from manual composer fields to Apex methods, compliance archiving, limit counting, and where native Salesforce leaves you without options.

Every email sent from Salesforce can include CC (carbon copy) and BCC (blind carbon copy) recipients, but the rules change depending on which sending method you use. Individual emails in the Lightning support manual CC and BCC fields. Apex allows programmatic control through the setCcAddresses and setBccAddresses methods with strict recipient caps. Compliance BCC silently archives every outbound message to a designated address. Yet native mass email, List Email, and Flow Builder Send Email actions offer no CC or BCC capability at all. This gap forces teams to choose between manual workarounds and native Salesforce tools that deliver flexible, automated CC and BCC at scale. Understanding where each method works, where it breaks, and how to fill the gaps ensures your organization maintains compliance records, keeps stakeholders informed, and logs every customer touchpoint inside the CRM. For a comprehensive overview of BCC logging functionality, see the MassMailer BCC email template guide.

CC and BCC in the Lightning Email Composer

When you compose an email from a Contact, Lead, or Case record in Lightning Experience, the email composer displays To, CC, and BCC fields. You can add any valid email address or search for Salesforce records directly in these fields. CC recipients are visible to everyone on the email, while BCC recipients remain hidden from other recipients. Each address you add to To, CC, or BCC counts as a separate recipient against your daily single email limit. Salesforce logs the email as an Activity on the primary recipient’s record, but CC and BCC recipients do not automatically receive their own Activity History entries unless they match existing Contact or Lead records with Enhanced Email enabled.

Salesforce Classic offers similar CC and BCC functionality through its HTML email editor, accessible from Activity History on any record. However, Classic’s composer lacks the modern lookup and auto-complete features available in Lightning. In both experiences, the CC and BCC fields accept free-text email addresses and Salesforce record references interchangeably. For organizations using Enhanced Email (enabled by default since Spring ’19), sent emails are stored as EmailMessage records rather than Task records, providing richer metadata including CC and BCC address fields that are queryable via SOQL.

Automatic BCC and Compliance BCC Settings

Salesforce provides two distinct BCC settings that serve different purposes. Automatic BCC is a personal setting (My Settings → Email → My Email Settings) that sends a copy of every outbound email to the user’s own email address. This helps individual reps maintain a personal archive in their inbox alongside the Salesforce Activity record. Each user controls their own Automatic BCC toggle independently. For more on email logging methods, see the Salesforce email log guide.

Compliance BCC is an org-wide admin setting (Setup → Email Administration → Compliance BCC Email) that automatically sends a hidden copy of every outbound email to a single designated address. Enabling Compliance BCC disables all users’ ability to edit the BCC field and overrides individual Automatic BCC settings. This is designed for regulated industries such as financial services and healthcare, where every customer communication must be archived for audit purposes. The compliance copy excludes system emails like password resets and import notifications. Organizations in sectors requiring archival compliance should also review the MassMailer email archiving guide for automated approaches.

Email-to-Salesforce: BCC for CRM Logging

Email-to-Salesforce provides each user with a unique BCC email address found under My Settings → Email → My Email to Salesforce. When users add this address to the BCC field of emails sent from any external client (Gmail, Outlook, Apple Mail), Salesforce automatically logs the email to matching Contact, Lead, or Opportunity records based on recipient email addresses. Salesforce matches a maximum of 50 email addresses from the To and CC fields, and each received email creates up to 50 Activity entries. For the complete setup process, see the Email-to-Salesforce setup guide.

Using BCC rather than CC or To for the Salesforce logging address is recommended because it keeps the internal routing address hidden from external recipients. However, Email-to-Salesforce has notable limitations: logging depends entirely on users remembering to add the BCC address, matching requires exact email address correspondence with existing records, and unmatched emails go to the My Unresolved Items queue for manual assignment. The method also does not capture email opens, clicks, or engagement data. For organizations wanting automated logging without manual BCC steps, Einstein Activity Capture or native CRM tools provide fully automated alternatives that eliminate human error from the logging process.

Apex CC and BCC: setCcAddresses and setBccAddresses Methods

The SingleEmailMessage class in Apex provides setCcAddresses() and setBccAddresses() methods for programmatic CC and BCC control. Each method accepts a list of email addresses or Salesforce record IDs (Contacts, Leads, Users). The maximum is 25 recipients per CC field and 25 per BCC field, with a combined ceiling of 150 total recipients across To, CC, and BCC. Every recipient in all three fields counts against the daily single email sending limit. The 4,000-byte maximum field size further constrains the number of long email addresses you can include.

A critical restriction applies when Compliance BCC is enabled at the org level: Apex calls to setBccAddresses() return the error BCC_NOT_ALLOWED_IF_BCC_COMPLIANCE_ENABLED. This means organizations using Compliance BCC cannot programmatically add additional BCC recipients through Apex unless they disable compliance archiving. Developers should query the organization’s compliance settings before attempting BCC operations. For organizations needing both compliance archiving and dynamic BCC recipients, native Salesforce email tools provide template-level BCC configuration that works alongside compliance requirements. Learn more about Salesforce email automation approaches that support flexible CC and BCC.

CC and BCC Gaps in Flow Builder and Mass Email

Flow Builder’s Send Email action is one of Salesforce’s most-used automation tools, yet it provides no native CC or BCC fields. Emails triggered by Record-Triggered Flows, Scheduled Flows, or Screen Flows can only specify a primary recipient through the target record. There is no way to add additional CC or BCC addresses through standard Flow configuration. This limitation forces teams to either build custom Apex invocable actions (adding development overhead and maintenance burden) or accept that automated emails cannot copy stakeholders. The same gap exists in legacy Workflow Rule email alerts and Process Builder email actions. Review Salesforce email automation options for a full comparison of automation tools and their capabilities.

Native mass email and List Email present an even larger gap: neither supports CC or BCC recipients at all. When you send a List Email to 200 contacts, there is no option to CC a manager or BCC a compliance address on each message. This restriction also applies to Salesforce Campaigns email sends. Organizations that need CC or BCC on bulk communications must either send emails individually (impractical at scale) or use native AppExchange tools that provide template-level CC and BCC configuration for mass sends. For advanced CC and BCC features in bulk email, see the MassMailer CC and BCC options guide.

CC and BCC Impact on Daily Email Limits and Counting

Every address in the To, CC, and BCC fields counts as a separate email against your daily limits when sending through Apex or the API. If you send one email with one To address, one CC address, and one BCC address, Salesforce counts that as three emails toward your 5,000 daily single email limit. This counting method can rapidly deplete your sending capacity when CC and BCC are used extensively across automated processes. For example, an organization sending 1,000 emails daily with two CC recipients each consumes 3,000 emails from the daily pool, leaving only 2,000 for all other sending.

Emails sent to internal Salesforce users via setTargetObjectId() with User IDs do not count against the single email limit, but CC and BCC addresses added through setCcAddresses() and setBccAddresses() on the same message still count if they resolve to external addresses. Organizations approaching their daily email ceiling should audit CC and BCC usage patterns. Replacing broad CC distribution lists with Salesforce Activity logging, Chatter notifications, or report subscriptions can reclaim significant sending capacity without losing stakeholder visibility.

Compliance and Privacy Best Practices for CC and BCC

CC and BCC usage carries compliance implications under CAN-SPAM, GDPR, and industry-specific regulations. Every CC recipient becomes a visible party to the communication, meaning you must ensure that sharing recipient information across CC addresses does not violate privacy requirements. BCC protects recipient privacy by hiding addresses from each other, making it the preferred method for compliance archiving and multi-party notifications. Organizations in financial services should review Salesforce email marketing compliance for financial services for sector-specific guidance on BCC archiving requirements.

Establishing clear CC and BCC policies is essential: define when CC is appropriate (internal team visibility on customer communications), when BCC is required (compliance archiving, manager oversight), and when neither should be used (mass marketing where each recipient should receive an individually addressed message). Protect Email-to-Salesforce BCC addresses from external exposure because unauthorized parties could inject fraudulent Activity records into your CRM. Combine BCC archiving with email opt-out management to ensure that compliance logging does not override recipient unsubscribe preferences. Logging an email via BCC does not exempt the sender from CAN-SPAM or GDPR unsubscribe requirements.

Scalable CC and BCC with Native Salesforce Tools

Native Salesforce email functionality leaves significant CC and BCC gaps in automation, mass email, and template configuration. Organizations needing consistent CC and BCC across all sending methods require a platform that operates entirely within Salesforce. MassMailer provides template-level CC and BCC configuration, allowing administrators to define CC and BCC addresses directly in email templates rather than relying on manual entry or custom Apex code. Dynamic BCC uses merge fields to automatically copy record owners, account team members, or related users based on each recipient’s record data. Learn more about MassMailer’s advanced CC and BCC capabilities.

MassMailer’s CC and BCC features work across individual emails, mass campaigns, drip sequences, and Flow-triggered automations without the 25-recipient per-field cap or the Compliance BCC conflict that blocks native Apex setBccAddresses(). Global BCC configuration ensures every outbound email is archived to a designated address for audit readiness. Because MassMailer is 100% native to Salesforce, all CC and BCC activity is logged as permanent Salesforce records, maintaining complete visibility for email tracking and reporting without external data sync or middleware.

Stop losing visibility on customer emails. MassMailer delivers template-level CC and BCC, dynamic recipient automation, global BCC archiving, and unlimited sending—all 100% native to Salesforce. Schedule a personalized demo and see how flexible CC and BCC can transform your email operations.

Key Takeaways

  • Lightning email composer supports manual CC and BCC, but each address counts as a separate email against daily sending limits.
  • Compliance BCC archives every outbound email org-wide to a single address, but disables all users’ BCC editing and blocks Apex setBccAddresses() calls.
  • Email-to-Salesforce uses a unique BCC address per user to log external emails from Gmail or Outlook into matching CRM records automatically.
  • Apex setCcAddresses() and setBccAddresses() cap at 25 recipients each, with a combined 150-recipient ceiling across To, CC, and BCC fields.
  • Flow Builder, mass email, and List Email provide no native CC or BCC fields—the largest gap in Salesforce’s email recipient management.
  • MassMailer fills every CC and BCC gap with template-level configuration, dynamic recipients, global BCC archiving, and no per-field recipient caps.