# Outlook Blocked an HTML Attachment — Why, and What to Send Instead

Canonical: https://commareports.com/fix/outlook-blocked-html-attachment
Published: 2026-09-27

> Outlook and Gmail increasingly block, quarantine or strip .html attachments because phishing kits use them. Why your report got caught, why zipping or renaming it makes things worse, and the link that gets through.

# Outlook blocked the attachment

You email `weekly-report.html` and hear back one of:

- _"I can't open it — Outlook says it was blocked."_
- _"There's no attachment."_ (the gateway stripped it)
- Nothing, because it went to quarantine.

Nothing is wrong with the file. It looks exactly like an attack.

## Why HTML attachments get caught

A local HTML file is the phishing kit's favourite envelope. Opened from
the mail client, it can draw a pixel-perfect sign-in page and send
whatever is typed into it to any server — and because there is no URL in
the message, link scanners have nothing to check. So mail platforms treat
`.html` and `.htm` attachments as high-risk:

- **Outlook and Microsoft 365** can block them outright, and tenant admins
  commonly add them to the blocked-attachment list.
- **Corporate gateways** quarantine or strip them before the message
  reaches anyone.
- **Gmail** scans and warns on them, and blocks the ones it flags.

Your report is legitimate. The filter has no way to know that, and it is
right not to guess.

## What doesn't work

**Zipping it.** Gateways open archives and inspect what's inside;
password-protected zips are flagged _because_ they can't be inspected.

**Renaming it to `.txt`.** It may arrive, and then it opens as a page of
source code — [the next problem](/fix/html-file-shows-code-instead-of-page).

**Asking them to allow it.** In a managed tenant they usually can't, and
when they can, you've asked a colleague to weaken a control that exists
for good reason.

**Pasting the HTML into the email body.** Mail clients strip scripts,
most `<style>` rules and external assets, so the charts vanish and the
layout collapses — and the message may trip size limits too
([too big to email](/fix/html-file-too-big-to-email)).

## Send a link

Publish the report and put the URL in the email. It gets through where
the attachment didn't, and it's a better experience on the other end:

- Opens in one click, on a phone or a laptop, rendered exactly as you
  generated it — scripts, charts and styles included, inside a sandbox.
- Readers who shouldn't see it don't: public, password-protected,
  invite-only, or limited to your team or email domain —
  [sharing options](/docs/sharing).
- Feedback lands on the page. Readers select the figure they're asking
  about and [pin a comment to it](/comment-on-html), no account needed —
  instead of replying-all with a cropped screenshot.

For recurring reports, update the same report every run. The URL in last
week's email and this week's is the same link, now showing the current
version, with earlier ones kept in revision history. From a job:

```bash
curl -sS -X PATCH "https://commareports.com/api/v1/reports/$COMMA_REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  --data "$(jq -Rs '{html: .}' weekly-report.html)"
```

Then send `https://commareports.com/p/$COMMA_REPORT_ID` in the body.
Details in [publish from CI](/docs/ci) and [emailing an HTML report](/email-html-report).

## Try it

Comma is free — unlimited reports and unlimited commenters.

**[Publish the report, email the link →](https://commareports.com/)**

### Related

- [HTML report troubleshooting](/fix)
- [The HTML file is too big to email](/fix/html-file-too-big-to-email)
- [Slack won't preview an HTML file](/fix/slack-wont-preview-html-file)
- [HTML file shows code instead of the page](/fix/html-file-shows-code-instead-of-page)