SendGrid BCC failing or returning a 400? It's a personalizations validation error from duplicate or invalid addresses across to/cc/bcc. Here's the exact fix.
Updated Jul 1, 2026
The short answer
"SendGrid BCC not working" is almost always a Mail Send API validation error, not a delivery failure. SendGrid rejects the request (HTTP 400) when a bcc entry lacks a valid email, or when an address appears in more than one of to/cc/bcc in the same personalization, since SendGrid requires every address to be unique across those three arrays. Fix it by deduplicating recipients and giving each bcc object a valid email.
"SendGrid BCC not working" is rarely a silent delivery problem. In the v3 Mail Send API it almost always surfaces as an HTTP 400 Bad Request validation error before the message is ever queued. The bcc array lives inside each object of the personalizations array, and SendGrid validates it strictly.
There are three distinct, documented triggers, all returned as validation errors from POST /v3/mail/send:
bcc entry. Per SendGrid, "the bcc array, when used, must at least have an email parameter with a valid email address." An object with only a name, a malformed address, or an empty array element is rejected.to, cc, and bcc in the same personalization. This is the most common cause. SendGrid does not allow the same address in more than one recipient array within a single personalization object. The error reads: "Each email address in the personalization block should be unique between to, cc, and bcc. We found the first duplicate instance of [email address] in the personalizations.0.cc field." This is why a BCC recipient who is also in to or cc makes the whole call fail — and "BCC appears to do nothing" because the 400 means no email sent.bcc set to a bare string instead of an array of email objects.A subtler, non-error case: BCC is delivered, but the BCC recipient never appears in the visible headers (that is the point of blind carbon copy). If you only checked headers, BCC may actually be working.
1. Give every bcc object a valid email (name is optional):
{"personalizations": [{"to": [{ "email": "recipient@example.com" }],"cc": [{ "email": "manager@example.com", "name": "Manager" }],"bcc": [{ "email": "archive@example.com" }]}]}
2. Deduplicate across to, cc, and bcc. Before building the request, collect every address in the personalization and ensure none repeats across the three arrays. If archive@example.com is in both to and bcc, drop it from one. Do this per personalization object — addresses can repeat across different personalization objects.
3. Respect the recipient cap. SendGrid counts every address in to + cc + bcc (across all personalization objects) toward a 1,000-recipient maximum per request, and no more than 1,000 personalizations per request. Large BCC lists that silently fail are often over this limit — split into multiple API calls.
4. Read the response body. A 400 returns an errors array, where each entry has a message and a field (e.g. personalizations.0.bcc.0.email) pinpointing the offending entry. Log it rather than assuming "BCC is broken."
With Courier
References
FAQ
Because SendGrid requires every email address to be unique across the to, cc, and bcc arrays within a single personalization object. If a BCC address also appears in to or cc, the entire request is rejected with HTTP 400 and nothing is sent. Remove the duplicate from one of the arrays.
No. BCC (blind carbon copy) is designed to be hidden from other recipients and absent from visible headers. If the message is delivered but the BCC address isn't shown in To/Cc, that is correct behavior, not a bug.
All to, cc, and bcc addresses combined count toward a 1,000-recipient limit per API request, with a maximum of 1,000 personalizations per request. For larger lists, split the send across multiple Mail Send API calls.
One API, every provider
Courier connects to your email, SMS, and push providers, handles retries and failover, and surfaces delivery errors in plain language.
Last reviewed Jul 1, 2026. Courier is not affiliated with third-party providers; error behavior may vary by implementation.
© 2026 Courier. All rights reserved.