Send Contact Form 7 Submissions to Multiple Email Addresses

Contact Form 7 sends submissions to a single email address by default. Two built-in mechanisms handle multi-recipient scenarios without plugins or custom code: cc/bcc headers for broadcasting, and pipe-separated dropdown values for routing.

The Mail tab

All email configuration lives in the Mail tab of each form’s settings:

The fields that matter for multi-recipient delivery:

• To – primary recipient address
• Additional Headers – where cc: and bcc: lines go
• Mail (2) – an optional second email (autoresponder/confirmation to the submitter)

Mail tags like [your-name] and [your-message] are replaced with form field values in the subject, body, and recipient fields.

Scenario 1: same message to multiple recipients

Add cc: or bcc: lines to the Additional Headers field:

cc: [email protected], [email protected]
bcc: [email protected]

The cc recipients are visible to all recipients in the email headers. The bcc recipients are hidden. Separate multiple addresses with commas.

The To field can also accept multiple addresses directly ([email protected], [email protected]), but using Additional Headers keeps the routing separate from the primary recipient and is easier to audit.

Scenario 2: route to different recipients by category

Use CF7’s pipe separator in a dropdown field to map visible labels to hidden email addresses:

[select* message-type "Sales|[email protected]" "Tech Support|[email protected]" "Billing|[email protected]"]

The text before the pipe (Sales, Tech Support, Billing) is what the user sees in the dropdown. The text after the pipe is the value CF7 uses internally.

Set the To field in the Mail tab to the dropdown’s mail tag:

[message-type]

CF7 replaces [message-type] with the email address associated with the selected option. The user selects "Tech Support" from the dropdown; the submission goes to [email protected].

This pattern works for any routing scenario: department routing, regional offices, or topic-specific inboxes. The pipe separator is also available in radio buttons ([radio]) and checkboxes ([checkbox]), not just dropdowns.

Combining both methods

The two approaches compose. A form can route to a department via the pipe-separator dropdown in the To field while also cc’ing a supervisor on every submission via Additional Headers:

To: [message-type]
cc: [email protected]

For more complex routing (conditionally adding cc recipients based on form values, or sending entirely different emails per category), CF7’s Mail (2) tab provides a second independent email configuration. Enable it in the Mail tab to send a confirmation to the submitter or a separate notification to a different recipient list.

Header injection: do not put free-form user input in recipient fields

If a [textarea] value (or any field a determined submitter can put a newline into) is interpolated into the To field or Additional Headers, the embedded newline splits the header line and the attacker gets to add their own headers. The form becomes an open relay.

CF7 trims leading and trailing whitespace from submitted values (wpcf7_strip_whitespaces in includes/formatting.php) and strips null bytes, but it does not strip newlines from inside the value before substituting it into the mail template.

The safe pattern is to only interpolate mail tags whose values are constrained at the form level. The pipe-separated dropdown from Scenario 2 is safe: the submitter can only pick one of the values you defined. A [text], [email], or [textarea] field is not safe in headers: the value is whatever the submitter sent.

If a form needs to route to one of several internal addresses based on user input, define the addresses in a dropdown (or radio/checkbox) and reference the resulting mail tag. Never build a recipient string by concatenating a free-form field value.

CF7 sets a Reply-To: [your-email] header by default, using the submitter’s email field directly. That works because the field is validated as an email and a valid address cannot contain a newline. The same logic does not apply to [text] or [textarea].