Secure Email Automation with Extended MAPI in Delphi

Overview

Automating email securely from a Delphi application using Extended MAPI lets you send, read, and manage Outlook messages programmatically while leveraging the user’s configured mail profile and existing security controls. This guide shows a practical, secure approach: initializing MAPI, creating and sending messages, handling attachments, and following best practices to reduce security risks.

Prerequisites

Windows with Outlook installed and configured.
Delphi (XE or later recommended) with access to Windows SDK headers or a MAPI wrapper library (e.g., MAPI32 imports).
Basic familiarity with COM, Windows API, and Delphi exception handling.

Key security considerations

Use the user’s MAPI profile to avoid storing credentials.
Handle attachments carefully (scan for malware before sending).
Respect user consent and avoid background sending without explicit action.
Use proper error handling and release all MAPI resources to prevent leaks.

Initialization and logon

Call MAPIInitialize (if available) or ensure MAPI32 is ready.
Use MAPILogonEx to log on to the current user’s profile with MAPIEXTENDED flag if needed. Prefer interactive logon that uses the existing Outlook session to avoid requesting credentials.

Example outline (Delphi pseudocode):

pascal
var hSession: HSession; begin MAPIInitialize(nil); if MAPILogonEx(0, nil, nil, MAPI_EXTENDED or MAPI_LOGON_UI, hSession) = S_OK then begin // proceed end; end;

Creating and populating a message

Obtain IMAPISession and open the message store.

Use IMAPISession.OpenEntry to access the Outbox or Drafts folder.

Create a new message via IMessage or IMsgService and set properties: PR_SUBJECT, PR_BODY, recipients, and flags.

Add recipients using AdrList (distribution list) or create recipient rows.

Important: set PR_MESSAGE_FLAGS and PR_FLAG_STATUS carefully if you want to save as draft vs send immediately.

Adding attachments safely

Write attachment files to a trusted temporary folder (use GetTempPath + unique name).

Scan with antivirus APIs or invoke a local scanner before attaching.

Use IMessage::AttachFiles or create attachments via IAttach methods; set PR_ATTACH_DATA_BIN or PR_ATTACH_LONGFILENAME.

Pseudocode:

pascal
// create attachment, set filename and binary data Attach := IMessage.CreateAttach(...); Attach.SetProps(...); Attach.SaveChanges(0);

Sending the message

To send immediately, call IMessage::SubmitMessage or use the transport’s Send method.

Prefer saving to Drafts and prompting the user to review before final send when high security is required.

Handle Deferred Send scenarios by setting PR_CLIENT_SUBMIT_TIME.

Error handling and cleanup

Always check HRESULTs returned by MAPI calls.

Release COM interfaces (IMAPISession, IMessage, IAttach) with Release.

Call MAPIUninitialize when finished.

Log errors to a secure store; avoid recording sensitive message content in logs.

Example workflow (concise)

MAPIInitialize

MAPILogonEx (interactive, MAPI_EXTENDED)

Open message store -> open Outbox/Drafts

Create IMessage, set subject/body

Add recipients via ADRLIST

Create and attach files (scan before attach)

Save message

SubmitMessage (or save as draft and prompt user)

Release interfaces, MAPIUninitialize

Troubleshooting common issues

“Security prompts” from Outlook: use Extended MAPI with the user’s profile and ensure your app is trusted; avoid Simple MAPI which triggers prompts.

Missing interfaces: ensure correct MAPI32.dll and Outlook versions; prefer 32-bit app for 32-bit Outlook or match bitness.

Access denied on attachments: ensure temp file permissions allow the Outlook process to read them.

Best practices checklist

Use the user’s profile (no stored credentials).

Scan attachments before sending.

Ask user confirmation before sending programmatically.

Match process bitness with Outlook.

Properly release MAPI resources and handle errors.

References and further reading

Microsoft Extended MAPI documentation (search for latest on microsoft.com).

Delphi MAPI wrapper libraries and examples.

This provides a secure, practical approach to automate email with Extended MAPI in Delphi while minimizing common security pitfalls.

Secure Email Automation with Extended MAPI in Delphi