Email Attachments: Formats, Size Limits, and Security Considerations

Email Attachments: Formats, Size Limits, and Security Considerations

Invoices, reports, contracts — many business scenarios require sending files by email. But attachments come with real constraints.

Sending attachments with the Rovela API

const fs = require('fs');

await rovela.emails.send({
  from: 'billing@yourdomain.com',
  to: user.email,
  subject: 'Your invoice',
  html: '<p>Please find your invoice attached.</p>',
  attachments: [
    {
      filename: 'invoice-2024-001.pdf',
      content: fs.readFileSync('/path/to/invoice.pdf').toString('base64'),
      content_type: 'application/pdf',
    },
  ],
});

Size limits

Major providers cap attachment sizes:

Provider	Max total attachment size per email
Gmail	25 MB (send), 50 MB (receive)
Outlook	20 MB
QQ Mail	50 MB

Practical rule: if attachments exceed 5 MB, use a link instead — upload the file to object storage (S3, OSS) and include a download link in the email.

Use links for large files

// Generate a time-limited download link
const { getSignedUrl } = require('@aws-sdk/s3-request-presigner');
const url = await getSignedUrl(s3Client, new GetObjectCommand({
  Bucket: 'your-bucket',
  Key: `invoices/${invoiceId}.pdf`,
}), { expiresIn: 7 * 24 * 3600 }); // valid for 7 days

await rovela.emails.send({
  // ...
  html: `<p>Download your invoice (valid for 7 days): <a href="${url}">Download invoice</a></p>`,
});

Security considerations

• Don't attach user-uploaded files: user content may contain malicious code; attaching it means distributing it to other users
• Executable formats are filtered: .exe, .bat, .js and similar extensions are blocked by most providers
• PDFs can carry malicious content too: scan external PDFs before attaching them
• Use meaningful filenames: invoice-2024-001.pdf is far better than doc.pdf — users are more likely to open it

Set Content-Type accurately

Wrong Content-Type causes attachments to be treated as plain text. Common types:

• PDF: application/pdf
• Excel: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
• CSV: text/csv
• ZIP: application/zip