404 Tech Support

Gmail will block .js attachments

Google has announced that Gmail including G Suite (formerly Google Apps) will begin blocking attachments with the file extension of .js. This means you will not be able to send .js (typically Javascript) files from Gmail and people sending messages to Gmail accounts will receive a bounce message telling them that their message cannot be delivered. Google made this announcement on their G Suite blog. The restriction will go in place starting February 13, 2017.

Gmail users trying to send a message will see the attachment is “blocked for security reasons!” as shown in the screenshot above. The reason to block .js files is for security reasons and it joins other file types like .exe, .msc, and .bat.

.js files have their legitimate uses but are maliciously used for spearphishing attacks. My previous organization blocked .js files quite a while ago because the increased frequency of malicious attachments, the rise (again) of Office document macro malware, and the threat of ransomware. It was noted on many security sites that .docx.js files were being sent to spread malware and at that time we blocked the file extension.

If you still need to send a legitimate .js file, you can upload the file to Google Drive or other cloud storage and then send a link to the file to share it.

For a full list of file types that you cannot send to or from Gmail (including if you compress them in .zip files), visit this Google Support page for a current list.