Comma

Outlook blocked the attachment

You email weekly-report.html and hear back one of:

  • "I can't open it — Outlook says it was blocked."
  • "There's no attachment." (the gateway stripped it)
  • Nothing, because it went to quarantine.

Nothing is wrong with the file. It looks exactly like an attack.

Why HTML attachments get caught

A local HTML file is the phishing kit's favourite envelope. Opened from the mail client, it can draw a pixel-perfect sign-in page and send whatever is typed into it to any server — and because there is no URL in the message, link scanners have nothing to check. So mail platforms treat .html and .htm attachments as high-risk:

  • Outlook and Microsoft 365 can block them outright, and tenant admins commonly add them to the blocked-attachment list.
  • Corporate gateways quarantine or strip them before the message reaches anyone.
  • Gmail scans and warns on them, and blocks the ones it flags.

Your report is legitimate. The filter has no way to know that, and it is right not to guess.

What doesn't work

Zipping it. Gateways open archives and inspect what's inside; password-protected zips are flagged because they can't be inspected.

Renaming it to .txt. It may arrive, and then it opens as a page of source code — the next problem.

Asking them to allow it. In a managed tenant they usually can't, and when they can, you've asked a colleague to weaken a control that exists for good reason.

Pasting the HTML into the email body. Mail clients strip scripts, most <style> rules and external assets, so the charts vanish and the layout collapses — and the message may trip size limits too (too big to email).

Send a link

Publish the report and put the URL in the email. It gets through where the attachment didn't, and it's a better experience on the other end:

  • Opens in one click, on a phone or a laptop, rendered exactly as you generated it — scripts, charts and styles included, inside a sandbox.
  • Readers who shouldn't see it don't: public, password-protected, invite-only, or limited to your team or email domain — sharing options.
  • Feedback lands on the page. Readers select the figure they're asking about and pin a comment to it, no account needed — instead of replying-all with a cropped screenshot.

For recurring reports, update the same report every run. The URL in last week's email and this week's is the same link, now showing the current version, with earlier ones kept in revision history. From a job:

curl -sS -X PATCH "https://commareports.com/api/v1/reports/$COMMA_REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  --data "$(jq -Rs '{html: .}' weekly-report.html)"

Then send https://commareports.com/p/$COMMA_REPORT_ID in the body. Details in publish from CI and emailing an HTML report.

Try it

Comma is free — unlimited reports and unlimited commenters.

Publish the report, email the link →

Related