Reply-All and Cc Mistakes: How to Stop Internal Emails Reaching Outside People

How it happens

Two versions of the same mistake:

• The thread. A client emails you and Cc's your colleague. Your colleague replies to you with a frank comment about the client. You answer with reply-all, out of habit, and the client is still on the thread.
• The last-second Cc. You finish an internal note and add "Chris" to Cc. Autocomplete picks Chris from the agency, not Chris from your team.

Both times, an email written for people inside the company reaches someone outside it. Outlook add-ins like VIPRE SafeSend exist mostly for this, and the problem is the same whatever app you use.

Settings that help

Make Reply the default

• Gmail: gear icon, See all settings, General, Default reply behavior, choose Reply, Save Changes.
• Outlook on the web and new Outlook: Settings, Mail, Compose and reply, then under Reply or reply all choose Reply.
• Classic Outlook and Apple Mail have no default setting. Reply and Reply All are separate buttons, so the habit has to do the work.

Turn on the external recipient notice (admins)

• Microsoft 365: the External Recipients MailTip names outside recipients above the To line, in every version of Outlook. Steps are in our Outlook external recipient warning guide.
• Google Workspace: the external recipient warning shows a banner when you reply to outside people, though it skips your contacts. Steps are in our Gmail external recipient warning guide.

Neither one stops the send.

Turn up the undo window

Gmail goes to 30 seconds, Outlook on the web to 10, Apple Mail to 30. It gives you a chance if you see the client's name the moment after you click Send.

Habits that help more

• Never discuss a client inside the client's thread. Forward it to your colleague as a new email, so the client is not on it.
• Open the recipient line before you reply. Long threads collapse To and Cc into a short line. Click it and read every name.
• Type the full address the first time. "chris.lee@yourcompany" instead of "Chris" and a pick from the list.
• Clean up autocomplete. Old outside contacts with common first names cause most wrong picks. Our guide to autocomplete sending email to the wrong person shows how in Gmail and Outlook.

A check that looks at Send, not while you write

The hard case is the Cc added at the very end. The email was fine while you wrote it, and the outside address arrived in the last few seconds. A notice shown while writing can miss it. A check that runs when you click Send cannot.

Presend is a Chrome extension that checks every email at Send, in Gmail, Outlook on the web and other places you write in the browser. With its External recipients check set to Block:

• an email with an outside address in To or Cc stops with "Hold on", and the outside addresses are listed
• a recipient added after the body was written is caught, because the check reads the recipients at Send
• if you click Send anyway and then change the recipients, it asks again

You can also make it narrower, so routine client replies go through and only the risky ones stop: "Block an email to an outside address that talks about the client in a negative way", or "Block any email to an outside address that mentions pricing".

Using Gmail only? The Gmail version of this guide has the same steps for Gmail. If an internal comment has already reached a client, see how to send a correction email.