Gmail doesn’t block PDFs as a file type. It blocks a message when an attachment looks like it could spread malware, or when a ZIP holds a blocked file type, and over 25 MB it swaps the file for a Drive link. In a PDF, the parts that can carry code are scripts, automatic actions and attached files. Remove those and send it again.
Runs in this tab, on pdf.js, pdf-lib and qpdf (WebAssembly), so your file is read from your own device and never sent anywhere. Check it yourself
How do I fix it?
1Read what the warning saysA security warning and a size warning need different fixes. If a bounce came back, check which server sent it: a gmail.com address means Gmail, anything else means the recipient’s side.
2Check the PDF in PDF Privacy ScannerDrop the PDF. The report lists what the file carries besides its pages: scripts and automatic actions, attached files, comments, form data and metadata. Nothing is uploaded while it looks.
3Save a clean copyLeave Remove scripts and automatic actions and Remove attached files ticked and press Save a clean copy. The pages look exactly as before; the parts that could run code are gone.
4Attach the PDF itself, not a ZIPSend the clean PDF on its own. If it is over the limit, make it smaller with Compress PDF rather than zipping it — zipping barely shrinks a PDF and adds a layer for the filter to distrust.
Why does this happen?
Something inside the PDF looks risky. Google says it blocks content that “might share viruses” without publishing exactly what trips it. A PDF can carry JavaScript, actions that run when it opens, and other files tucked inside it. A plain document exported from Word or a scanner has none of these; a PDF built from a template, a form tool or a file someone else sent you may.
It is zipped with something Gmail refuses. Gmail blocks executable and script types such as .exe, .js and .bat, including inside ZIP and other archives, and it blocks password-protected archives that contain another archive. A PDF zipped together with one of those is blocked with them.
It is over 25 MB. Not a block, but often mistaken for one: for personal Gmail accounts, attachments over 25 MB in total are taken off the email and replaced with a Google Drive link. Work and school accounts have limits set by their administrator.
The recipient’s mail server rejected it. Gmail delivered it; the company at the other end didn’t accept it. Corporate mail filters set their own rules and can be stricter about files they can’t inspect. The bounce message names the server that refused it.
Questions
Does Gmail block password-protected PDFs?
Google’s published list doesn’t include them, and banks email password-protected statements to Gmail every day. What Google does block is password-protected archives containing other archives. A company mail filter on the recipient’s side may still refuse files it can’t scan.
Will zipping the PDF get it past the block?
No, and it shouldn’t. Gmail looks inside archives, and if the PDF itself is the problem a ZIP changes nothing. Remove the risky parts instead, so the file is genuinely clean.
Does this mean my PDF has a virus?
Not necessarily — a form with a script that adds up totals can trip the same check. But if the PDF came from someone else, treat the warning seriously: don’t open it in a desktop reader with scripting on, and ask the sender for a plain copy.
What is the Gmail attachment size limit?
25 MB in total per email for personal accounts. Above that, Gmail replaces the attachment with a Google Drive link. Work and school accounts follow their administrator’s settings.