# Attachment or link? How to send documents by email > Attachment or link? Gmail and Outlook size limits, delivery and security scans, version mix-ups, taking access back and privacy, with a rule for each case. By The Breathier team. Published 2026-11-15. Web page: https://breathier.com/resources/send-a-link-not-an-attachment Attach a document when it is small, finished, not sensitive and the person needs their own copy to keep. Send a link when the file is large, still changing, confidential, or when you might want to take access back or know whether it was read. Below, using the providers' own rules: attachment limits in Gmail and Outlook, what security scanning does to delivery, why attachments breed conflicting versions, what you can recall after pressing send, and where your document ends up. ## The short answer Five questions settle most cases. If any answer lands in the right-hand column, send a link. | Question | Attach the file | Send a link | |---|---|---| | How big is it? | Comfortably under 15 MB | Over 15 MB, or you don't know the recipient's limits | | Is it final? | Yes, it won't change | It may be corrected or updated | | Is it sensitive? | No | Yes, or it contains personal data | | Might you need to take it back? | No | Yes, or it has a shelf life | | Do you need to know it was read? | No | Yes | ## How big can an attachment be? Every provider caps the size of a message, attachments included. These are the published limits, checked on 15 November 2026 (they change, so check the linked pages): | Service | Published limit | Notes | |---|---|---| | Gmail (personal account) | 25 MB | Bigger files are swapped for a Google Drive link automatically | | Google Workspace | 25 MB on Business, Education and Enterprise Standard; up to 50 MB on Enterprise Plus | Measured before encoding; the 50 MB figure is for Gmail on the web only | | Outlook app with an internet account (Outlook.com, Gmail, other IMAP or POP mail) | 20 MB | Includes the message itself, not just the files | | Exchange Online (Microsoft 365 work mailboxes) | 35 MB to send, 36 MB to receive, by default | Administrators can set anything from 1 MB to 150 MB | | Exchange Server run in-house | 10 MB by default | Set by the organisation's administrator | | Apple Mail Drop (iCloud) | Up to 5 GB | Sent as a download link that expires after 30 days | Microsoft's pages disagree slightly: its Outlook help page gives 10 MB for business accounts, which is the Exchange Server default, while Microsoft 365 mailboxes default to 35 MB. Either way, your administrator's setting is what counts. ### Why a 20 MB file fails a 20 MB limit Email was designed for text, so attachments are converted into text before they travel. The standard that defines this, RFC 2045, says the encoded data come out about 33 per cent larger than the original. Microsoft's Exchange Online documentation makes the same point: messages that leave Microsoft's data centres are subject to a 33 per cent encoding increase. So a 20 MB PDF becomes roughly 27 MB in transit. Where a limit is measured after encoding, the largest file that fits under 20 MB is about 15 MB. Google measures its sending limit before encoding but its Workspace receiving limits (50 MB on Enterprise Standard, 70 MB on Enterprise Plus) after it. ### The smallest limit wins Your message must fit through your provider, every server in between and the recipient's mailbox, and you know only the first. A 22 MB attachment sent happily from Workspace Enterprise Plus can bounce off a company that allows 10 MB. The providers know this, which is why they quietly turn big attachments into links. Gmail swaps oversized files for a Drive link, Outlook's error message suggests sending a link to a shared location, and Mail Drop uploads the file and sends a link. Past a certain size you are sending a link anyway; the only question is which one, with what rules. ## Delivery: will it arrive, and when? Size is not the only hurdle. Business mail is scanned, and attachments get the closest look. - **Sandboxing.** Microsoft Defender for Office 365's Safe Attachments opens attachments in a virtual environment before delivery. Microsoft says scanning typically completes within 15 minutes and safe messages "might be delayed"; with Dynamic Delivery, the email arrives with placeholders until each attachment is cleared. - **Password-protected files.** A scanner cannot look inside a file it cannot open. Safe Attachments can quarantine password-protected attachments it can't scan, and Gmail refuses password-protected archives outright. Zipping a file with a password to "make it secure" can mean it never arrives. - **Blocked types.** Gmail will not let you attach executable files such as .exe or .js, even inside a .zip. Links are scanned too: Microsoft's Safe Links checks URLs before delivery and again at the click. But a link is a few bytes of text, not a multi-megabyte file to unpack and test. Recipients are wary of both. The US Cybersecurity and Infrastructure Security Agency (CISA) advises caution with unexpected attachments even from people you know, and checking with the sender another way. Google's guidelines for senders ask that links be visible and easy to understand. Either way, say plainly what you are sending and why, and warn people if they aren't expecting it. ## Versions: the "final_v3_really_final" problem An attachment is a frozen copy. Send a proposal to five people, spot a typo an hour later and send it again, and there are now ten copies in circulation, half of them wrong, with nothing to stop someone replying to the old one. Forwarding multiplies the problem. Outlook acknowledges the choice: for a file stored in OneDrive, it offers to attach a copy or share a link to the file itself, which sends everyone to one place. Decide one subtlety deliberately. A live editing link (a shared Google Doc, say) shows whatever the document says now: ideal for collaborating, less so when you need a record of exactly what a client saw on Tuesday. A link to a fixed file gives you one place to send people and a clear record of the version behind it. If you need to correct it, upload the corrected file, send a fresh link and close the old one. ## Taking it back: what you can and cannot recall Once an attachment lands, it belongs to the recipient's mailbox, and the tools for pulling it back are narrower than most people assume. | Method | What it does | The catch | |---|---|---| | Gmail Undo Send | Cancels a message before it goes | Only for 5, 10, 20 or 30 seconds, depending on your setting | | Outlook recall | Deletes unread copies of a message | Only when you and the recipient both have Microsoft 365 work or school accounts in the same organisation, and they haven't opened it; not available for Gmail or Outlook.com addresses | | Gmail confidential mode | Lets you set an expiry date and remove access | Google warns recipients can still take screenshots or photos | | Google Drive sharing | Remove people or change who can open the file | Per-person expiry dates exist only for work and school accounts, up to a year ahead | | A link with its own rules | Switch it off, or let it expire | Anything already downloaded, printed or photographed stays out of reach | That last row is the honest limit of every option: a link closes the door but cannot reach into someone's downloads folder. If a document must not be kept, block downloading and accept that a screenshot is still possible. ## Privacy: who ends up holding your document Every attachment creates copies: in your Sent folder, in each recipient's inbox, in every forward and in backups. Google counts Gmail attachments, even in Spam and Trash, towards the 15 GB of free storage shared across Gmail, Drive and Photos, a reminder that they stay put. One of the easiest ways for a document to go astray involves no hacking at all, just a wrong address. Autocomplete suggests the wrong Sam, you press send, and a contract is in a stranger's inbox. With an attachment, that is the end of the matter. With a link, you can switch it off the moment you notice. Links have their own risk: they can be forwarded. Google is explicit that "Anyone with the link" means anyone on the internet who has it can open the file without signing in. Treat a link like a key and give it rules: - **A passcode**, sent by a different route from the link (a text message rather than the same email). Our guide on [how to password-protect a document you share by link](https://breathier.com/resources/password-protect-a-shared-document) covers choosing and sending one. - **An expiry date**, so access ends when the deal or the deadline does. - **Download off**, which removes the easy way to keep a copy. It is a deterrent, not a guarantee. - **One link per recipient**, so forwarding shows up as a stranger on someone's link rather than vanishing into a shared one. If your link records who reads what, say so; it is fairer than letting people find out later. Our guide to [seeing who opened your PDF and which pages they read](https://breathier.com/resources/track-who-opened-a-pdf) goes into what tracking can and cannot do. ## How to send a document as a link, step by step Here is the process with [Breathier](https://breathier.com/), a free tool for sharing documents by link and seeing who read them; most sharing services work similarly. 1. **Upload the file as it is.** PDF, Word, PowerPoint, Excel, CSV and common image formats, up to 50 MB a file (15 MB for spreadsheets and CSV). Nothing is converted: readers see it in the browser laid out like the original, and a download is exactly the file you uploaded. 2. **Create a link for each recipient** and name it after them, such as "Acme Ventures". One document can have up to 50 links. 3. **Set the rules for that link:** ask for an email address (typed by the reader and not verified), add a passcode, set an expiry date, and allow or block downloading. 4. **Write the email.** Say what the document is, how long it is and what you would like the reader to do, with the link plainly visible. When pasted into WhatsApp, LinkedIn or Slack, a Breathier link shows the document's title and first page (except on links with a passcode). 5. **Send the passcode separately**, if you set one. 6. **Check the statistics**: each visit, the time on each page and whether the file was downloaded (readers are told on the link's page that you can see this). Our guide to [document analytics and what time on each page tells you](https://breathier.com/resources/document-analytics-explained) explains how to read them. 7. **Switch the link off** when it has done its job. Anyone still reading is closed out within seconds. Know the limits: Breathier doesn't email you when someone opens a document, and has no e-signatures, watermarks or team accounts. ## When an attachment is still the right choice Links are not always better. Attach the file when: - **The recipient has asked for a file**, such as an invoice for their accounts system. - **They need to read offline**, on a flight or with a patchy connection. - **The file is small, final and harmless**, like a one-page agenda. - **You want the document inside the email thread** as a record that travels with the conversation. For anything large, confidential or still in draft, a link is lighter, safer and easier to correct. There are more practical guides in our [resources hub](https://breathier.com/resources). ## FAQ ### What is the maximum attachment size in Gmail? Personal Gmail accounts can send up to 25 MB of attachments in one message (checked on 15 November 2026); over that, Gmail swaps the files for a Google Drive link. Google Workspace allows 25 MB on most editions and up to 50 MB on Enterprise Plus in Gmail on the web. ### What is the attachment limit in Outlook? The Outlook app sets 20 MB for internet accounts such as Outlook.com or Gmail. Microsoft 365 work mailboxes default to 35 MB for sending and 36 MB for receiving, adjustable by administrators from 1 MB to 150 MB (checked on 15 November 2026). ### Why did my 18 MB attachment bounce? Attachments are encoded as text for the journey, which makes them about a third bigger, so an 18 MB file travels as roughly 24 MB. If any server along the way, including the recipient's, counts the encoded size against a 20 MB limit, the message is rejected. Keep attachments under about 15 MB or send a link. ### Are links more likely to land in spam than attachments? Neither Google's nor Microsoft's guidance says one is favoured over the other, and both are scanned. What Google does say is that links should be visible and clearly described, and hidden content can push a message into spam. A plain message from a known sender, saying what the link is, is your best protection. ### Can I unsend an email with an attachment? Only briefly or in narrow cases. Gmail's Undo Send gives you up to 30 seconds, and Outlook's recall works only on unopened messages between work or school accounts in the same organisation. A shared link can be switched off at any time, though copies already downloaded stay downloaded. ### Is it safe to send a confidential document as a link? Safer than an attachment, if the link has rules: a passcode sent separately, an expiry date and, where it matters, downloading blocked. An open link can be forwarded and no link stops a screenshot, so for sensitive material use one link per person and close each when done. ## Sources - [Google Gmail Help: Add attachments in Gmail](https://support.google.com/mail/answer/6584?hl=en): the 25 MB limit for personal accounts, automatic Google Drive links for larger files, and attachments counting towards storage (checked on 15 November 2026). - [Google Workspace Admin Help: Gmail sending limits in Google Workspace](https://knowledge.workspace.google.com/admin/gmail/gmail-sending-limits-in-google-workspace?hl=en): 25 MB and 50 MB attachment limits by edition, measured before encoding (checked on 15 November 2026). - [Google Workspace Admin Help: Gmail receiving limits in Google Workspace](https://knowledge.workspace.google.com/admin/gmail/gmail-receiving-limits-in-google-workspace?hl=en): 50 MB and 70 MB receiving limits, measured after encoding, which adds about 37 per cent (checked on 15 November 2026). - [Google Gmail Help: File types blocked in Gmail](https://support.google.com/mail/answer/6590?hl=en): blocked executable types and password-protected archives. - [Microsoft Support: Send large files with Outlook](https://support.microsoft.com/en-us/office/send-large-files-with-outlook-8c698842-b462-4a4c-8d53-5c5dd04f77ef): 20 MB for internet accounts, 10 MB default for Exchange accounts, and sending a cloud link instead (checked on 15 November 2026). - [Microsoft Learn: Attachment size exceeds the allowable limit error](https://learn.microsoft.com/en-us/troubleshoot/outlook/message-body/attachment-size-exceeds-the-allowable-limit-error): Outlook's 20 MB (20,480 KB) default and its error message suggesting a link. - [Microsoft Learn: Message size and recipient limits in Exchange Server](https://learn.microsoft.com/en-us/exchange/mail-flow/message-size-limits): the 10 MB default message size limits for Exchange Server run by an organisation (checked on 15 November 2026). - [Microsoft Learn: Exchange Online limits](https://learn.microsoft.com/en-us/office365/servicedescriptions/exchange-online-service-description/exchange-online-limits): 35 MB and 36 MB defaults, the 1 to 150 MB range and the 33 per cent encoding increase (checked on 15 November 2026). - [Apple Support: Mail Drop limits](https://support.apple.com/en-us/108329): 5 GB attachments sent as links that expire after 30 days (checked on 15 November 2026). - [RFC 2045, section 6.8 (IETF)](https://www.rfc-editor.org/rfc/rfc2045): Base64 encoded data are about 33 per cent larger than the original. - [Microsoft Learn: Safe Attachments in Microsoft Defender for Office 365](https://learn.microsoft.com/en-us/defender-office-365/safe-attachments-about): sandbox scanning, typical 15-minute scans, Dynamic Delivery and quarantining password-protected attachments. - [Microsoft Learn: Safe Links overview](https://learn.microsoft.com/en-us/defender-office-365/safe-links-about): URLs scanned before delivery and checked again at the time of click. - [Google Workspace Admin Help: Email sender guidelines](https://support.google.com/a/answer/81126?hl=en): links should be visible and easy to understand; hidden content can lead to spam. - [CISA: Using Caution with Email Attachments](https://www.cisa.gov/news-events/news/using-caution-email-attachments): treat unexpected attachments with care, even from known senders, and verify through another channel. - [Microsoft Support: Send files as attachments](https://support.microsoft.com/en-au/office/send-files-as-attachments-8409b359-5da6-4f81-96b2-310a82257e7f): Outlook's choice between attaching a copy and sharing a OneDrive link. - [Google Gmail Help: Send or unsend Gmail messages](https://support.google.com/mail/answer/2819488?hl=en): the 5, 10, 20 or 30 second Undo Send window. - [Microsoft Support: Recall or replace a sent email](https://support.microsoft.com/en-us/office/recall-or-replace-a-sent-email-8e564127-15a0-4cf6-b974-f2101f5e256e): recall works only for unopened messages between work or school accounts in the same organisation. - [Google Gmail Help: Send messages and attachments confidentially](https://support.google.com/mail/answer/7674059?hl=en): expiry, removing access, and the warning that screenshots are still possible. - [Google Drive Help: Share and manage access to files and folders in Google Drive](https://support.google.com/drive/answer/2494822?hl=en): what "Anyone with the link" means, removing access and per-person expiry dates. - [Google One Help: How storage works](https://support.google.com/googleone/answer/9312312?hl=en): 15 GB shared across Gmail, Drive and Photos, including attachments (checked on 15 November 2026).