What’s the difference between attachment filtering and content filtering?

Attachment filtering and content filtering are two different checkpoints that sit on the same mail server, looking at different parts of your message. They can both block you, and the fix for each is different.

Attachment filtering looks at the files

Attachment filtering inspects what you stapled to the message. It checks the file extension, the actual file type (MIME type), the size, and runs the bytes through an antivirus engine. Some filters unpack ZIPs and look inside. Some refuse password-protected archives outright because they cannot scan what they cannot open.

The rules are usually blunt. Microsoft 365 blocks roughly 100 file extensions by default in Exchange Online Protection, including .exe, .js, .vbs, .jar, and .iso, regardless of who sent them or what the message says. See the Microsoft list of blocked attachment types. Gmail blocks a similar set and will bounce or strip the file.

Attachment filters also flag macro-enabled Office files (.docm, .xlsm), HTML attachments, and anything that looks like an installer. If you send invoices as .exe you will never reach an inbox, and no amount of warm-up will fix that.

Content filtering reads the message

Content filtering looks at the subject line, the body text, the HTML, the links, and the headers. It checks for spam patterns, phishing language, suspicious link redirects, image-to-text ratio, and structural junk like broken HTML or hidden white text on white backgrounds.

This is where the machine-learning models and heuristic rules live. The filter does not care whether you attached a file. It cares that your subject says "URGENT: verify your account" and your body links to a domain that was registered 48 hours ago. For a deeper view of what signals get weighed, see what signals filters analyze and how machine-learning models detect spam.

The two run independently

That is the part that trips people up. An attachment filter can block a clean, well-written message because it carried a .zip with a script inside. A content filter can block a message with no attachment at all because the copy reads like a phishing kit.

A few real patterns we see at Review My Emails:

• Sales rep sends a perfectly written follow-up with a .html attachment of a proposal. Microsoft 365 strips it. Recipient gets the message with a note that the attachment was removed. The rep thinks the email was delivered fine. It was not really.
• Marketing sends a newsletter with no attachments. Gmail tabs it as Promotions or routes it to spam because the HTML is 95% image, the unsubscribe link is missing, and the from-domain reputation is shaky.
• An invoicing system sends PDFs that are fine on content but the PDF contains a JavaScript action. Some filters reject the PDF as suspicious.

Different fix in each case.

How to tell which one blocked you

Check the SMTP response or the non-delivery report. Attachment blocks usually name the file or extension: "message contains a blocked attachment type", "552 file type not allowed", or a 5.7.1 with a reason about content. Content filter blocks usually reference spam scoring, policy, or a specific rule ID. The difference between 5xx permanent and 4xx temporary rejections tells you whether to retry or rewrite.

If you cannot see the bounce, send the same message twice. Once with the attachment, once without. If the no-attachment version delivers, you have your answer.

What to do about it

For attachment problems, host the file and send a link instead. Use a Google Drive, Dropbox, or your own CDN. Strip macros from Office files. Never send executables to people who did not ask for them.

For content problems, fix the copy. Cut the phishing-style urgency, balance text and images, make sure every link points to a domain that matches your from-address, include a real unsubscribe header, and authenticate with SPF, DKIM, and DMARC.

Both filters have to say yes. One no, and you are out.