The one-sentence version#
Attachment and link security covers scanning files and URLs in inbound mail (sandboxing, detonation, URL rewriting and time-of-click checks) and safe handling policies for outbound content.
Why you should care#
Malicious attachments and links remain the main payload delivery method for ransomware and credential theft.
The mental model#
Think of email attachment and link security as a contract between you and the mailbox providers receiving your mail. You publish or configure something they can check; they check it on every message; the result feeds their decision about where your message lands. Everything below is about making that check pass consistently.
Your first setup, step by step#
- Block executable and macro-enabled attachment types at the gateway.
- Enable URL rewriting with time-of-click reputation checks.
- Sandbox unknown attachments before delivery.
- For outbound, prefer links to authenticated portals over attachments for sensitive files.
Words you will see#
- Mailbox provider: Gmail, Microsoft, Yahoo, Apple, and the corporate gateways that decide where mail lands.
- Authentication: proof that a message is from who it says it is (SPF, DKIM, DMARC).
- Reputation: the provider's running score of your domain and IP.
- Placement: whether a message reaches the inbox, spam, or is rejected.
Common mistakes#
- Allow-listing partner domains and bypassing scanning entirely.
- Password-protected archives that evade scanning.
Frequently asked questions#
Are PDF attachments safe?
Mostly, but PDFs can carry scripts and phishing links. Sandboxing and link rewriting still apply.