submission: Add automatic BCC support for relayed messages

[andrewachen]

Add per-user configurable BCC functionality to the submission service for message archiving. When submission_bcc is set, all messages relayed through the submission service will have a copy sent to the configured address.

We need to archive outgoing messages for specific users via per-user BCC addresses for compliance purposes.

New Settings

• submission_bcc: BCC recipient address (empty = disabled)
• submission_bcc_ignore_errors: If no (default), the DATA command fails when the relay rejects the BCC recipient. If yes, delivery proceeds with a warning logged.

Configuration Example

Per-user BCC via passdb extra fields:

# /etc/dovecot/submission-users
alice:password::::::userdb_submission_bcc=alice-archive@backup.example.com
bob:password::::::userdb_submission_bcc=bob-archive@backup.example.com userdb_submission_bcc_ignore_errors=yes
carol:password::::::

# dovecot.conf
passdb {
  driver = passwd-file
  args = scheme=PLAIN username_format=%u /etc/dovecot/submission-users
  override_fields = userdb_import=submission_bcc submission_bcc_ignore_errors
}

Note: The userdb_ prefix is required for passdb extra fields to override service settings. The userdb_import directive in override_fields enables importing these fields as settings.

Implementation Details

• BCC recipient is added on the first RCPT command, before regular recipients
• SMTP pipelining ensures the BCC RCPT response arrives before DATA is processed
• In strict mode (submission_bcc_ignore_errors=no), the DATA command fails if the BCC recipient was rejected
• In best-effort mode (submission_bcc_ignore_errors=yes), BCC rejection is logged as a warning but delivery proceeds to regular recipients