Attachments blocked or flagged as dangerous

What it means

Attachments are the most common way to spread viruses by email. So receiving servers treat them carefully:

• Dangerous file types are blocked. Gmail, Outlook and most company filters refuse programs and scripts, such as .exe, .bat, .js, .vbs, .scr or .iso, even inside a .zip.
• Office files with macros (.docm, .xlsm) are often quarantined.
• Encrypted archives (password-protected zip) cannot be scanned, so many filters block them.
• Large emails bounce. Many servers refuse messages above 20 to 25 MB, and attachments grow by about a third once encoded for email.

Why it matters

Your email may be refused with an error, silently removed, or delivered without the file. Even when it arrives, an unexpected attachment from an unknown sender raises the spam score and trains people to ignore you.

How to check

Delivmail checks this for you in two ways:

• Send a test email: on the home page (/), copy your unique test address, send it a normal email from the mailbox you want to check, then open the report. Attach the same file you normally send. The SpamAssassin section shows any rules triggered by the attachment.
• If a recipient gets a bounce, read it: messages such as 552 message size exceeds limit or "attachment blocked for security reasons" tell you exactly what went wrong.

How to fix it

Choose safe formats

• Documents: PDF is the safest choice. Plain .docx and .xlsx without macros are usually fine.
• Images: .jpg and .png.
• Never send programs or scripts by email. Put them on a download page instead.

Keep emails small

• Stay under about 10 MB in total to be safe with most receivers.
• Compress large PDFs and resize photos before attaching them.
• Do not send the same large file to a whole mailing list.

Send a link instead

For big files, many files, or newsletters, upload the file to your website or a trusted cloud drive (Google Drive, OneDrive, Dropbox) and send a link. Check that the link domain is not blacklisted at /blacklists, and prefer links to your own domain.

Make the email trustworthy

1. Write a real message in the body explaining what the file is. An email with only an attachment and no text looks suspicious.
2. Use a clear file name, such as invoice-2026-041.pdf, not document.pdf.exe or a random string.
3. Make sure SPF, DKIM and DMARC pass: filters are much stricter on attachments from unauthenticated senders.
4. Scan your own files with an up-to-date antivirus before sending.

Invoices and automatic emails

If your shop or billing tool sends invoices, many tools let you send a secure link to the invoice instead of an attachment. It is lighter, safer, and easier to update.

Check that it is fixed

Send the new version, with the safer file or the link, to a fresh Delivmail test address. The report should show a lower spam score and no rules about the attachment. Then send it to a colleague on another provider and confirm the file arrives intact.