Safe and usable email attachments

Attach only necessary files with accurate media types, safe names, bounded size, malware controls, and an accessible alternative where possible.

What it is

Attachments are MIME body parts with a media type, content disposition, transfer encoding, and optional filename parameters.

Why it matters

Large or dangerous attachments trigger filtering and create accessibility, privacy, and device-storage costs.

How to implement

Set an accurate content type, sanitize the filename, encode international names correctly, scan generated and uploaded files, limit size, and prefer authenticated download links for sensitive or changing documents.

Common mistakes

  • Trusting an uploaded file extension as its media type.
  • Including personal data in the filename.
  • Attaching inaccessible image-only PDFs.

Verification

Open the delivered file on multiple platforms, inspect MIME metadata, test a non-ASCII filename, and confirm malware and size controls execute before queueing.

Sources

  1. RFC 2183 — Content-Disposition header field — IETF
  2. RFC 2231 — MIME parameter value extensions — IETF