networking - How can email possibly be routed to the right place with no to: address?

I'm no novice on networking technology, but one thing I don't really know much about in detail is email and headers. How does email work SPECIFICALLY?

I'm getting spam in my hotmail inbox when I've made painful attempts to not give out my actual email. I use my own domain name to forward email to my inbox using several aliases. Yet now I'm getting spam with no address in the to: line, or also "undisclosed recipients". Looking at the headers is of no help whatsoever.

So from a technical standpoint, I have to wonder... if I send an email to a certain address in my personal domain and it gets forwarded to my hotmail account, how does hotmail know what inbox to dump the message in if that address is not listed in the headers?

Answer

This is a fairly common source of confusion. There are two places in a standard email transmission where the to: address is specified - once in the "envelope" and once in the visible email headers.

The envelope recipient address is specified during the SMTP transaction, and you will never see the value that is set there. It is solely used by the SMTP server to route the message.

The to: header in the email itself is optional, which is what you're seeing in your hotmail account.

Here's the flow of a standard SMTP transaction:

erik@host:~$ telnet localhost 25
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
220 localhost ESMTP Postfix (Ubuntu)
helo example.com
250 localhost

mail from: erik@example.com
250 2.1.0 Ok
rcpt to: jimbob@example.com
250 2.1.5 Ok
data
354 End data with .
To: foobar@example.com
Subject: This is the subject

This is the message body.

.
250 2.0.0 Ok: queued as 19CE221FDA

The address specified after rcpt to: is the the envelope recipient address. The address specified in the to: line after data is what shows up in your email client. These two values do not have to match, and as mentioned earlier, the to: in the data portion is optional.