Skip to content
Open Engine

Home Topics Email Security Management Attachment and link security

Email Security Management · Attachment and link security

Email attachment and link security not working? Troubleshooting guide

MailMaid Academy · · 1 min read DMARC pass
Short answer

When email attachment and link security fails, check in this order: the DNS or platform configuration is published and resolves; the sending system is actually using it; the domain in headers aligns with what you published; and the receiver's verdict in Authentication-Results or bounce messages.

Symptoms#

  • Messages landing in spam despite previously good placement
  • Bounces mentioning policy, authentication, or reputation
  • Provider dashboards showing a drop in reputation or authentication pass rate

Diagnosis steps#

  1. Confirm the configuration is live: query DNS from an external resolver and check the sending platform's settings page.
  2. Send to a seed mailbox and read the full headers, especially Authentication-Results.
  3. Compare the domains in From, Return-Path, and DKIM d= for alignment.
  4. Check provider dashboards (Google Postmaster Tools, Microsoft SNDS) for reputation and error rates.
  5. Review recent changes: new vendors, DNS edits, list imports, volume spikes.

Likely causes#

  • Allow-listing partner domains and bypassing scanning entirely.
  • Password-protected archives that evade scanning.

Fix and re-verify#

  1. Block executable and macro-enabled attachment types at the gateway.
  2. Enable URL rewriting with time-of-click reputation checks.
  3. Sandbox unknown attachments before delivery.
  4. For outbound, prefer links to authenticated portals over attachments for sensitive files.

Frequently asked questions#

Are PDF attachments safe?

Mostly, but PDFs can carry scripts and phishing links. Sandboxing and link rewriting still apply.

Keep reading on Attachment and link security