Stop Heavy Email Attachments

Because almost every mailbox enforces a total message size between 10 MB and 25 MB, and your attachment is measured after encoding, not before. Email cannot carry binary data directly, so files are Base64-encoded in transit and grow by roughly a third — a 20 MB scan travels as about 27 MB and fails against a 25 MB ceiling that looked generous.

The limit that matters is the smallest one on the path. Your outbound provider, the recipient's provider, and any scanning gateway in between each apply their own cap, so a message that leaves your server can still be refused at the far end. This is why the same document reaches one client and not another.

Silent failures are worse than bounces. Gateways strip attachments by extension, quarantine archives, and rewrite messages without telling the sender, so a client can reasonably believe the file was sent while your file still shows nothing received.

There are three realistic replacements, and they are not interchangeable. A cloud storage share link solves the size problem but hands the client a folder rather than a request, so you get files with no indication of which item they satisfy. A consumer transfer service delivers reliably but expires, tracks nothing, and leaves you re-downloading a ZIP into a local folder.

A document request portal is the one designed for the job: each requested item has its own upload slot, so an arriving file is already attributed to a specific requirement. That attribution is the whole difference — it is what lets you answer "what is still outstanding?" without opening anything.

The test to apply is not capacity. Ask whether the tool can tell you, without human reading, which of the twelve items in a case are received, which are under review, and which have never been touched.

Less than you would expect, if the link is designed well. The client receives a message, taps one link, and sees the list of documents you need with their own upload buttons. There is no password to choose and no account to remember, which is what makes a magic-link handoff faster than the email it replaces.

They also gain something email never gave them: the ability to check their own progress. A client who is unsure whether they already sent the lease can open the same link and look, instead of emailing you to ask — which removes a category of message from your inbox entirely.

The one habit to set deliberately is the reply-with-attachment reflex. Keep answering those messages, but answer by re-sending the link, and the habit fades within a case or two.

Do not migrate the archive. Attachments already received for closed cases can stay where they are under your existing retention rules; the work of extracting them rarely pays for itself, and it duplicates personal data into a second system for no operational gain.

For cases still open, upload the attachments you already hold into the matching request items yourself and mark them received. It takes a few minutes per case and it means the file is complete in one place from day one, rather than split between a portal and a thread nobody remembers to check.

Then draw a line: from a fixed date, new requests go out as links only. A partial migration where both routes stay open is the failure mode, because the inbox quietly remains the source of truth.

It concentrates responsibility, which is an improvement. Attachments in email are copied to every recipient's mailbox, every forwarded thread, and every local download folder, so a deletion request is impossible to honour completely. Files held against a request item exist once, with a known location and a known owner.

Retention becomes something you can actually configure. Because the file is attached to a case rather than a conversation, you can expire access when the case closes and delete on a schedule instead of relying on someone remembering to empty a folder.

Under GDPR, that also makes the minimisation argument easier to make: you can show which documents were requested, why, and when they were removed. Read the rules alongside what a compliant collection process looks like before you set your retention periods.