When you send an email, it doesn't go directly from the sender to the receiver. It is sent via a mail protocol (e.g. SMTP) to a mail server, which then routes it to the mail server responsible for the target address, or just stores it if the sender and receiver servers are the same. From there the target asks their mail server (via another mail protocol, e.g. POP3) for any new emails, and downloads it.
For example (domain names not accurate):
- Alice, whose email address is
firstname.lastname@example.org, wants to send an email to
- Alice looks up the MX DNS entry for
homtail.com and gets
mx1.hotmail.com, so she connects there and sends the email via SMTP, optionally via TLS for security.
mx1.hotmail.com looks at
email@example.com and finds the MX entry for
gmail.com, which is
mx1.gmail.com. The Hotmail server forwards the email along to Gmail.
- Bob checks his email. He talks to
mx1.gmail.com via POP3, optionally over TLS, and gets the email.
This is an oversimplification, since the forwarding step often involves sending the email to a mail exchange gateway of some kind, which then selects which internal mail server it should be sent to.
Whilst the protocols involved may be encrypted, the emails and their attachments are not encrypted when they reach the mail server. At any point in this chain, the email contents could be inspected or modified. They may do some form of malware scan on the files, or strip attachments based on whatever policy they choose.
The standard way of preventing this is to use an email encryption scheme, e.g. GPG. This involves encrypting the data at the sender's end and decrypting it again at the receiver's end, with keys shared via asymmetric crypto.