Source: https://once-email.com/blog/attachment-safety-checklist Message safety · Aug 3, 2026Updated Aug 23, 2026 # A Safe Checklist Before Downloading an Email Attachment Check the request, sender, file name, type and handling environment before downloading an attachment—and know what email previews and scanners cannot prove. [Once Email Engineering, Once Email author Once Email Engineering]() Reviewed by Once Email security review What this guide helps you do Readers can stop before download, verify a request through a trusted channel and choose a safer environment without mistaking metadata for proof of safety. Article guide Why this article is worth your time **Original analysis** The checklist uses successive decision gates—expected request, independent sender check, filename, type and handling environment—rather than trusting one scanner result. **Trend context** Malicious file formats and platform defences continue to change, while unexpected context, misleading extensions and active content remain durable warning signals. **Practical value** Readers can stop before download, verify a request through a trusted channel and choose a safer environment without mistaking metadata for proof of safety. An attachment can be dangerous even when its filename looks ordinary, the message uses a familiar logo or the sender's domain passes email authentication. Before downloading, decide whether the file was expected, whether you can verify the request independently and whether the device and software you plan to use are appropriate for the risk. Once Email receives attachments but does not send mail and does not claim to scan files for malware. A displayed filename, MIME type or download link is descriptive metadata, not a safety verdict. ## [How large can an attachment be?]() Once Email's receiving gateway rejects an entire message above 10,240,000 bytes (about 9.77 MiB). That number includes the body, headers and encoded attachments. Because Base64 packaging commonly adds about one third, a raw file close to 10 MB will not fit. For predictable delivery, keep each ordinary document at or below 5 MiB and leave room for the rest of the message; this is guidance, not a promise that every sender or route will deliver it. Size is a resource limit, not a safety check. Once Email does not currently certify attachments as virus-free. A PDF, text file, CSV or office document can still contain harmful links, macros or malformed content. Executables, scripts, disk images, password-protected archives and macro-enabled documents should not be opened here. If a file is unexpected, do not download it. If it is expected, scan it with current protection on your device or an approved organisational service. ClamAV's own documentation describes malware detection as a configurable scanning layer and notes that scanners cannot unpack every format or variant; a clean result is therefore risk reduction, not proof. Google likewise blocks various executable formats, malicious macros and password-protected archives, while Microsoft recommends verifying unexpected attachments through a separate trusted channel. These are useful defensive layers, but neither a familiar extension nor a negative scan proves that a file is safe. ## [1. Stop if the attachment was not expected]() Ask what real event should have produced the file. Did you request an export, apply for the document, open a support case or agree that this person would send it? Urgency is not evidence. An unexpected invoice, delivery notice, résumé, legal threat or “security report” should be treated as unverified even when the topic feels plausible. Microsoft's [phishing protection guidance]() advises users not to open suspicious links or unexpected attachments and to contact the organisation through official contact information. Do not reply to the message and ask whether it is real if the mailbox or sender account itself may be compromised. Use a phone number, application or website you already trust. If you cannot explain why the file arrived, the safest download is no download. ## [2. Verify the sender through a separate channel]() The visible display name can be copied. A ` From ` address can be forged, and a genuine account can be compromised. SPF, DKIM and DMARC results provide useful domain-level evidence but do not certify the sender's intent or the attachment contents. For an important file, confirm with the sender using an established conversation or known contact method. Ask for the purpose and expected filename, not a password or secret. If a company supposedly sent the document, open its official site or application independently instead of using a link in the same message. The [email authentication guide]() can help you interpret header results, but a passing result never replaces this contextual check. ## [3. Read the full filename, not just the icon]() Enable display of complete filenames and extensions in the operating system. Attackers can use long names, repeated spaces, right-to-left characters or multiple extensions to make an executable resemble a document. A file named ` statement.pdf.exe ` is an executable regardless of the PDF word in the middle. Treat executable and script-capable formats as high risk, including platform-specific installers, scripts, shortcuts and disk images. Office documents and PDFs are not automatically harmless: they can contain active content, links or exploit malformed file parsers. Archives can conceal the real file type and may be password-protected specifically to prevent a mail provider from inspecting their contents. Do not rename a blocked file to force it open. A mail client warning is a reason to verify the delivery method with the sender or security team, not a puzzle to bypass. Microsoft documents that Outlook [blocks attachment types considered potentially unsafe]() ; the exact block list is product-specific and should not be treated as a complete malware list. ## [4. Compare metadata, but do not trust it alone]() The message may declare a MIME type such as ` application/pdf `, while the downloaded bytes represent another format. The filename extension and declared type can both be incorrect or intentionally misleading. A file-size value is also not proof: a tiny script can be harmful, while a large archive may merely be inconvenient. Use metadata to find inconsistencies, not to certify safety. If an expected PDF is described as an executable, or the sender expected one image but the message contains an encrypted archive, stop and verify. Once Email displays attachment information supplied through the received message; it does not guarantee that the data matches the file's true format. ## [5. Protect the device before saving or opening]() Keep the operating system, browser, document viewer and security software current. Save the file without automatically opening it. Scan it with the security controls approved for the device or organisation, and follow any quarantine warning. A clean scan reduces known risk but does not prove a file is safe. New or targeted malware may not be detected, and online scanning services may retain or share uploaded samples. Do not upload a confidential contract, personal record, source archive or customer file to a public scanner without authority and a clear data-handling policy. For higher-risk authorised analysis, use an organisation-managed isolated environment and involve the security team. A personal computer, production server or device holding valuable credentials is not an appropriate malware laboratory. Do not execute a suspicious file merely to see what it does. ## [6. Consider whether you need the file at all]() Many legitimate services provide the same document inside a signed-in portal. Retrieving it from the known application can be safer than opening an email attachment. Ask whether a plain-text summary, protected file share or newly generated export would meet the need. If the attachment contains a verification code or temporary record, save only the minimum information needed and respect its retention requirements. The [email test evidence guide]() explains why copying a complete ` .eml ` message or mailbox export can expose unrelated headers, tokens and personal data. ## [7. Report suspicious mail without spreading the file]() Use the mail provider's phishing or abuse-reporting function when available. In a workplace, follow the security team's reporting channel. Do not forward a suspicious attachment casually to colleagues; forwarding can create more copies and more opportunities to open it. Record a minimal description: when it arrived, the claimed sender, why it was unexpected, the filename and the warning shown. Redact recipient addresses, tokens and internal identifiers before placing evidence in a broadly visible ticket. Preserve the original message only according to an authorised incident process. If you already opened the file and the device behaves unexpectedly, disconnect from sensitive work as your organisation directs and contact its security support. Do not hide the event or continue entering passwords while investigating alone. ## [Download decision]() Download only when you expected the file, verified the sender through a trusted route, understand the complete filename and format, and have an appropriate patched environment for handling it. Stop when the message creates urgency without context, the file type conflicts with the request, a client blocks it or the only way forward is to weaken a security control. An attachment arriving successfully proves delivery, not safety. The goal of the checklist is not to predict every malicious file; it is to avoid turning an unverified message into code or active content on a device you care about. ## [After a safe download decision]() Once Email only receives and delivers the attachment; it does not preview or unpack files, inspect archive contents or send them to an online unpacking service. If several expected archives must be organised, follow the [local UnpackFlow batch guide]() . It keeps browser download, local planning, verification, source cleanup and inbox deletion as separate decisions, with source packages retained whenever a part is missing, damaged, password-protected or unverified. ## Related guides How to Inspect Email Links and Tracking Pixels Without Opening Them Review email HTML locally for dangerous schemes, nested redirects, misleading domains, remote images and tracking-pixel clues without rendering the message. [How to Inspect Email Links and Tracking Pixels Without Opening Them]() Email Verification Codes: A Safer Way to Copy, Check and Use Them Treat an email verification code as a short-lived secret: confirm the request, inspect the destination, copy only the code and clear it when the task is finished. [Email Verification Codes: A Safer Way to Copy, Check and Use Them]() Batch-download Email Attachments and Unpack Them Locally with UnpackFlow Use a dedicated folder, verify every browser download, then list, plan and unpack multipart or nested archives locally without uploading them to an online service. [Batch-download Email Attachments and Unpack Them Locally with UnpackFlow]() ## Use a related tool Email attachment size budget Estimate how selected attachments may grow after Base64 and MIME packaging before sending an email. [Email attachment size budget]() [How to Read Received Headers and Trace an Email Delivery Path Follow Received header fields in the correct order, compare timestamps safely and recognise the limits of hostnames, IP addresses and untrusted trace data.]() [A Privacy-First Decision Tree for Email Sign-Ups Choose between a permanent address, forwarding alias and temporary receive-only inbox by checking recovery, payments, records, replies and website policy.]()