The first thing most people do when Outlook blocks an attachment is rename the file—changing .exe to .txt or adding a space before .zip. That’s not just sloppy—it breaks digital signatures, corrupts macros, and fails silently in Exchange environments. Worse, it trains Outlook to distrust *all* future files from that sender.
The Problem
Outlook blocks attachments based on file extensions—not content. It’s hardcoded behavior, not a setting you can toggle off with a checkbox. The list lives deep in Outlook’s security layer: .ade, .adp, .app, .asp, .bas, .bat, .chm, .cmd, .com, .cpl, .crt, .csh, .der, .exe, .fxp, .hlp, .hta, .inf, .ins, .isp, .its, .js, .jse, .ksh, .lnk, .mad, .maf, .mag, .mam, .maq, .mar, .mas, .mat, .mav, .maw, .mda, .mdb, .mde, .mdt, .mdw, .mdz, .msc, .msh, .msh1, .msh1xml, .msh2, .msh2xml, .mshxml, .msi, .msp, .mst, .nsh, .pif, .prf, .prg, .reg, .scf, .scr, .sct, .shb, .shs, .tmp, .url, .vb, .vbe, .vbs, .vbx, .vsmacros, .vss, .vst, .vsw, .ws, .wsc, .wsf, .wsh.
This list hasn’t changed since Outlook 2003. It’s baked into the client—and enforced differently depending on whether you’re on Outlook desktop (365/2019/2016), Outlook Web App, or connected to Exchange Online. If your IT admin has set up transport rules or Safe Attachments policies, those override local settings entirely. What most people don’t realize is: Outlook doesn’t block because the file is dangerous—it blocks because Microsoft decided *that extension* is *potentially* dangerous, full stop.
The Fix
You can’t delete the blocked list—but you *can* add trusted senders to a bypass list. This works only in Outlook desktop (not OWA), and only for users with local admin rights. Here’s how:
1. Close Outlook completely.
2. Press
Win + R, type
regedit, and press Enter.
3. Navigate to
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Security (for Outlook 365/2019) or
HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Security (for Outlook 2013/2016).
4. Right-click the
Security key →
New →
String Value.
5. Name it
Level1Remove.
6. Double-click it and enter the extensions you want to unblock, separated by semicolons—e.g.,
.ps1;.jar;.zip (no spaces).
7. Restart Outlook.
The beauty of this approach is that it leaves Outlook’s default protections intact while letting your team exchange legitimate scripts or packaged tools. Note: This only affects *incoming* attachments. Outgoing files still get scanned—but won’t be stripped.
If That Doesn't Work
Try these in order—most likely to least:
•
Check Group Policy: If your organization uses Active Directory, your IT team may have deployed the
Disable Attachment Scanning policy via GPO. You won’t see it in Outlook options—but it overrides everything else.
•
Exchange Online Protection (EOP): In Outlook Web App, attachment blocking happens at the mail flow level—not client-side. Go to
Admin Center > Exchange > Mail flow > Rules and search for “attachment” or “block”. Only admins can adjust these.
•
Safe Attachments in Microsoft Defender for Office 365: If enabled, files are detonated in a sandbox *before* delivery. Even if you whitelist an extension locally, Defender may still quarantine it. Look for the banner “This file was scanned by Microsoft Defender for Office 365” below the attachment.
•
Third-party AV interference: Some endpoint tools (like Symantec Endpoint Protection or McAfee) inject their own attachment filters. Temporarily disable real-time scanning and test.
Preventing It Next Time
Don’t wait until Friday afternoon before a demo to discover your .ps1 script got stripped. Start now:
• Use
Ctrl+R to reply *with original attachments*—Outlook preserves them in replies unless explicitly removed.
• For internal teams, ask your Exchange admin to add your domain to the
Trusted Senders and Domains list in EOP. That bypasses many attachment restrictions automatically.
• Compress sensitive files inside a password-protected ZIP (use 7-Zip, not Windows Explorer’s built-in ZIP)—Outlook allows .zip but blocks .ps1 directly. Yes, it’s clunky—but it’s reliable across all versions.
Here’s a surprising tip: Outlook 365 builds after v2308 (August 2023) let you unblock attachments *per-message* via the ribbon. When a blocked file appears, click the warning bar →
More actions →
Allow this attachment. That choice sticks for 24 hours—and only for that sender.
Related Settings
These settings interact directly with attachment blocking—and often get overlooked:
•
File > Options > Trust Center > Trust Center Settings > Email Security > Encrypted email: If S/MIME is enabled, some blocked file types (like .p7m) behave differently.
•
File > Options > Mail > Message format > Internet message format: Under “When sending messages in Rich Text Format”, check “Send pictures with document” — this impacts how embedded objects (not attachments) are handled.
•
File > Options > Advanced > Outlook start and exit > Disable hardware graphics acceleration: Rare, but GPU-accelerated rendering has caused false positives in attachment parsing on some Surface Pro 9 and Dell XPS configs.
•
File > Options > Mail > Editor Options > Proofing > AutoCorrect Options > AutoFormat As You Type: Turning off “Internet and network paths with hyperlinks” prevents Outlook from auto-converting file paths into links—which sometimes triggers attachment-like blocking logic.
| Symptom |
Cause |
Fix |
Prevention |
| Attachment shows as “(blocked)” in message body |
Extension matches Outlook’s Level1 list |
Add extension to Level1Remove registry value |
Use .zip wrappers for internal distribution |
| No attachment visible—even though sender says they attached one |
Exchange Online transport rule stripping files before delivery |
Ask admin to review mail flow rules in EAC |
Use SharePoint or OneDrive links instead of attachments |
| Blocked attachment reappears after reboot |
Registry change applied to wrong Outlook version key (e.g., 15.0 vs 16.0) |
Verify Outlook version in File > Account > About Outlook, then edit correct registry branch |
Bookmark this page—version numbers change with updates |
| Outlook Web App shows “This file type is blocked” but desktop doesn’t |
OWA uses server-side filtering; desktop uses client-side |
Switch to desktop Outlook for sensitive file transfers |
Standardize on desktop Outlook for dev/QA teams |
| Attachment opens but immediately closes |
Windows SmartScreen blocking (not Outlook) |
Right-click file → Properties → Check “Unblock” checkbox |
Sign internal scripts with Authenticode certificates |
| “Blocked” warning appears on .xlsx files with macros |
Outlook treats macro-enabled Excel files as high-risk |
Save as .xlsb (Excel Binary) instead—it’s allowed and faster |
Train analysts to use .xlsb for internal reporting workbooks |
