I am currently developing a tool that transfers emails and their attachments from Outlook to a local folder.

Currently, I am denying the message/rfc822 attachment because of legacy code reasons.

Now I am running into the problem that when people reply to my Email it sometimes will get denied because of this attachment.

Is it safe to whitelist this attachment type or would this be a potential security risk?

1 Answer 1


There is nothing inherently wrong with message/rfc822.

It is kind of special from the perspective of the MIME standard since it includes the original mail as-is, i.e. no additional Content-Transfer-Encoding on top of it is possible. This is a problem when transferring attached 8bit-encoded mails over 7bit-only infrastructures. There is the message/global Content-Type to deal with this, but it is not widely supported.

Also, message/rfc822 is not widely used in practice: not all mail clients are able to display it properly, not all mail clients are able to generate it (i.e. "forward as attachment" instead of the more common "forward inline"). And because of this there might be security systems which cannot properly deal with such types either, or which are simply configured to allow only the commonly used types for security reasons.

  • Thanks a lot for your answer! Commented Jun 23, 2023 at 12:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .