Skip to content
breathier.
Log inShare a document

Attachment or link? How to send documents by email

Attachment or link? Gmail and Outlook size limits, delivery and security scans, version mix-ups, taking access back and privacy, with a rule for each case.

By The Breathier team · Published · 10 min read

A person at a home office desk typing an email on a laptop, with a stack of paper documents and envelopes pushed to one side.

Attach a document when it is small, finished, not sensitive and the person needs their own copy to keep. Send a link when the file is large, still changing, confidential, or when you might want to take access back or know whether it was read. Below, using the providers' own rules: attachment limits in Gmail and Outlook, what security scanning does to delivery, why attachments breed conflicting versions, what you can recall after pressing send, and where your document ends up.

The short answer

Five questions settle most cases. If any answer lands in the right-hand column, send a link.

Question Attach the file Send a link
How big is it? Comfortably under 15 MB Over 15 MB, or you don't know the recipient's limits
Is it final? Yes, it won't change It may be corrected or updated
Is it sensitive? No Yes, or it contains personal data
Might you need to take it back? No Yes, or it has a shelf life
Do you need to know it was read? No Yes

How big can an attachment be?

Every provider caps the size of a message, attachments included. These are the published limits, checked on 15 November 2026 (they change, so check the linked pages):

Service Published limit Notes
Gmail (personal account) 25 MB Bigger files are swapped for a Google Drive link automatically
Google Workspace 25 MB on Business, Education and Enterprise Standard; up to 50 MB on Enterprise Plus Measured before encoding; the 50 MB figure is for Gmail on the web only
Outlook app with an internet account (Outlook.com, Gmail, other IMAP or POP mail) 20 MB Includes the message itself, not just the files
Exchange Online (Microsoft 365 work mailboxes) 35 MB to send, 36 MB to receive, by default Administrators can set anything from 1 MB to 150 MB
Exchange Server run in-house 10 MB by default Set by the organisation's administrator
Apple Mail Drop (iCloud) Up to 5 GB Sent as a download link that expires after 30 days

Microsoft's pages disagree slightly: its Outlook help page gives 10 MB for business accounts, which is the Exchange Server default, while Microsoft 365 mailboxes default to 35 MB. Either way, your administrator's setting is what counts.

Why a 20 MB file fails a 20 MB limit

Email was designed for text, so attachments are converted into text before they travel. The standard that defines this, RFC 2045, says the encoded data come out about 33 per cent larger than the original. Microsoft's Exchange Online documentation makes the same point: messages that leave Microsoft's data centres are subject to a 33 per cent encoding increase.

So a 20 MB PDF becomes roughly 27 MB in transit. Where a limit is measured after encoding, the largest file that fits under 20 MB is about 15 MB. Google measures its sending limit before encoding but its Workspace receiving limits (50 MB on Enterprise Standard, 70 MB on Enterprise Plus) after it.

The smallest limit wins

Your message must fit through your provider, every server in between and the recipient's mailbox, and you know only the first. A 22 MB attachment sent happily from Workspace Enterprise Plus can bounce off a company that allows 10 MB.

The providers know this, which is why they quietly turn big attachments into links. Gmail swaps oversized files for a Drive link, Outlook's error message suggests sending a link to a shared location, and Mail Drop uploads the file and sends a link. Past a certain size you are sending a link anyway; the only question is which one, with what rules.

Delivery: will it arrive, and when?

Size is not the only hurdle. Business mail is scanned, and attachments get the closest look.

  • Sandboxing. Microsoft Defender for Office 365's Safe Attachments opens attachments in a virtual environment before delivery. Microsoft says scanning typically completes within 15 minutes and safe messages "might be delayed"; with Dynamic Delivery, the email arrives with placeholders until each attachment is cleared.
  • Password-protected files. A scanner cannot look inside a file it cannot open. Safe Attachments can quarantine password-protected attachments it can't scan, and Gmail refuses password-protected archives outright. Zipping a file with a password to "make it secure" can mean it never arrives.
  • Blocked types. Gmail will not let you attach executable files such as .exe or .js, even inside a .zip.

Links are scanned too: Microsoft's Safe Links checks URLs before delivery and again at the click. But a link is a few bytes of text, not a multi-megabyte file to unpack and test.

Recipients are wary of both. The US Cybersecurity and Infrastructure Security Agency (CISA) advises caution with unexpected attachments even from people you know, and checking with the sender another way. Google's guidelines for senders ask that links be visible and easy to understand. Either way, say plainly what you are sending and why, and warn people if they aren't expecting it.

Versions: the "final_v3_really_final" problem

An attachment is a frozen copy. Send a proposal to five people, spot a typo an hour later and send it again, and there are now ten copies in circulation, half of them wrong, with nothing to stop someone replying to the old one. Forwarding multiplies the problem.

Outlook acknowledges the choice: for a file stored in OneDrive, it offers to attach a copy or share a link to the file itself, which sends everyone to one place.

Decide one subtlety deliberately. A live editing link (a shared Google Doc, say) shows whatever the document says now: ideal for collaborating, less so when you need a record of exactly what a client saw on Tuesday. A link to a fixed file gives you one place to send people and a clear record of the version behind it. If you need to correct it, upload the corrected file, send a fresh link and close the old one.

Taking it back: what you can and cannot recall

Once an attachment lands, it belongs to the recipient's mailbox, and the tools for pulling it back are narrower than most people assume.

Method What it does The catch
Gmail Undo Send Cancels a message before it goes Only for 5, 10, 20 or 30 seconds, depending on your setting
Outlook recall Deletes unread copies of a message Only when you and the recipient both have Microsoft 365 work or school accounts in the same organisation, and they haven't opened it; not available for Gmail or Outlook.com addresses
Gmail confidential mode Lets you set an expiry date and remove access Google warns recipients can still take screenshots or photos
Google Drive sharing Remove people or change who can open the file Per-person expiry dates exist only for work and school accounts, up to a year ahead
A link with its own rules Switch it off, or let it expire Anything already downloaded, printed or photographed stays out of reach

That last row is the honest limit of every option: a link closes the door but cannot reach into someone's downloads folder. If a document must not be kept, block downloading and accept that a screenshot is still possible.

Privacy: who ends up holding your document

Every attachment creates copies: in your Sent folder, in each recipient's inbox, in every forward and in backups. Google counts Gmail attachments, even in Spam and Trash, towards the 15 GB of free storage shared across Gmail, Drive and Photos, a reminder that they stay put.

One of the easiest ways for a document to go astray involves no hacking at all, just a wrong address. Autocomplete suggests the wrong Sam, you press send, and a contract is in a stranger's inbox. With an attachment, that is the end of the matter. With a link, you can switch it off the moment you notice.

Links have their own risk: they can be forwarded. Google is explicit that "Anyone with the link" means anyone on the internet who has it can open the file without signing in. Treat a link like a key and give it rules:

  • A passcode, sent by a different route from the link (a text message rather than the same email). Our guide on how to password-protect a document you share by link covers choosing and sending one.
  • An expiry date, so access ends when the deal or the deadline does.
  • Download off, which removes the easy way to keep a copy. It is a deterrent, not a guarantee.
  • One link per recipient, so forwarding shows up as a stranger on someone's link rather than vanishing into a shared one.

If your link records who reads what, say so; it is fairer than letting people find out later. Our guide to seeing who opened your PDF and which pages they read goes into what tracking can and cannot do.

Here is the process with Breathier, a free tool for sharing documents by link and seeing who read them; most sharing services work similarly.

  1. Upload the file as it is. PDF, Word, PowerPoint, Excel, CSV and common image formats, up to 50 MB a file (15 MB for spreadsheets and CSV). Nothing is converted: readers see it in the browser laid out like the original, and a download is exactly the file you uploaded.
  2. Create a link for each recipient and name it after them, such as "Acme Ventures". One document can have up to 50 links.
  3. Set the rules for that link: ask for an email address (typed by the reader and not verified), add a passcode, set an expiry date, and allow or block downloading.
  4. Write the email. Say what the document is, how long it is and what you would like the reader to do, with the link plainly visible. When pasted into WhatsApp, LinkedIn or Slack, a Breathier link shows the document's title and first page (except on links with a passcode).
  5. Send the passcode separately, if you set one.
  6. Check the statistics: each visit, the time on each page and whether the file was downloaded (readers are told on the link's page that you can see this). Our guide to document analytics and what time on each page tells you explains how to read them.
  7. Switch the link off when it has done its job. Anyone still reading is closed out within seconds.

Know the limits: Breathier doesn't email you when someone opens a document, and has no e-signatures, watermarks or team accounts.

When an attachment is still the right choice

Links are not always better. Attach the file when:

  • The recipient has asked for a file, such as an invoice for their accounts system.
  • They need to read offline, on a flight or with a patchy connection.
  • The file is small, final and harmless, like a one-page agenda.
  • You want the document inside the email thread as a record that travels with the conversation.

For anything large, confidential or still in draft, a link is lighter, safer and easier to correct. There are more practical guides in our resources hub.

FAQ

What is the maximum attachment size in Gmail?

Personal Gmail accounts can send up to 25 MB of attachments in one message (checked on 15 November 2026); over that, Gmail swaps the files for a Google Drive link. Google Workspace allows 25 MB on most editions and up to 50 MB on Enterprise Plus in Gmail on the web.

What is the attachment limit in Outlook?

The Outlook app sets 20 MB for internet accounts such as Outlook.com or Gmail. Microsoft 365 work mailboxes default to 35 MB for sending and 36 MB for receiving, adjustable by administrators from 1 MB to 150 MB (checked on 15 November 2026).

Why did my 18 MB attachment bounce?

Attachments are encoded as text for the journey, which makes them about a third bigger, so an 18 MB file travels as roughly 24 MB. If any server along the way, including the recipient's, counts the encoded size against a 20 MB limit, the message is rejected. Keep attachments under about 15 MB or send a link.

Neither Google's nor Microsoft's guidance says one is favoured over the other, and both are scanned. What Google does say is that links should be visible and clearly described, and hidden content can push a message into spam. A plain message from a known sender, saying what the link is, is your best protection.

Can I unsend an email with an attachment?

Only briefly or in narrow cases. Gmail's Undo Send gives you up to 30 seconds, and Outlook's recall works only on unopened messages between work or school accounts in the same organisation. A shared link can be switched off at any time, though copies already downloaded stay downloaded.

Safer than an attachment, if the link has rules: a passcode sent separately, an expiry date and, where it matters, downloading blocked. An open link can be forwarded and no link stops a screenshot, so for sensitive material use one link per person and close each when done.

Sources

Try it on your own document

Share one. See who reads it.

Share a document All guides
10 min readGoogle Drive sharing vs a tracked document link, and when to use eachWhat Google Drive's sharing and Activity dashboard show, which accounts see what, where they stop, and when a tracked document link fits better.10 min readFree DocSend alternatives compared on price, tracking and limitsWhat DocSend costs, and how Papermark, Google Drive, Dropbox and Breathier compare for sharing documents by link and seeing who read them.10 min readDocument analytics explained: what time on each page tells youLearn what visits, reading time and time on each page really mean in document analytics, which traps to avoid and how to act on what you see.