Check File Extension Risk Level for Email Attachments

Enter an extension such as .exe, docm, or holiday.jpg and receive its normalized extension, category, risk level, active-content status, and a practical filtering recommendation. The check is deterministic and runs without network access. It is designed for policy triage rather than content inspection, so its result should complement MIME verification, malware scanning, archive inspection, and organizational allowlists.

Use the final extension as a fast screening signal

Attachment filtering often begins before a scanner opens the file. The visible filename suffix is inexpensive to inspect and can immediately separate common executable files, interpreter-driven scripts, macro-capable office documents, and familiar media formats. Submit either a bare suffix such as docm, a dotted extension such as .DOCM, or a complete filename such as quarterly-report.docm. The checker trims surrounding whitespace, ignores letter case, removes a URL query or fragment, and classifies the final suffix. That last-suffix behavior matters for names such as invoice.pdf.exe: the result follows .exe, not the harmless-looking text earlier in the name. The response includes a normalized dotted extension, the policy category, a plain risk level, whether the type normally supports active content, an explanation, and a recommended filtering action. This makes the output convenient for mail gateways, support portals, workflow rules, and human review queues that need one predictable vocabulary. It remains a screening signal, however, because attackers can rename files and honest files can have inaccurate suffixes.

Understand the four attachment risk categories

The executable category covers formats that can launch code directly or participate in program installation and system configuration. It receives a critical risk level and a block-by-default recommendation. The script category covers source or command files that a shell, interpreter, browser host, or automation runtime may execute; these receive a high rating. The document-macro-capable category identifies Office-family formats whose suffix explicitly permits macros or active add-ins, including docm, xlsm, and pptm. These also receive a high rating because a document can look routine while carrying executable logic. The safe media category contains commonly exchanged image, audio, and video suffixes that are not normally launched as programs, and it receives a low rating. “Safe” is relative to attachment policy, not a guarantee that bytes are benign: malformed images can exploit vulnerable decoders, SVG can contain complex content, and a suffix can disagree with the real format. For that reason, even low-risk results recommend content-type verification and ordinary malware scanning rather than unconditional trust.

Handle unknown types conservatively and combine checks

An attachment filter should not interpret an unfamiliar suffix as evidence of safety. When the checker does not recognize an extension, it returns recognized: false and places the value in the executable policy bucket with a critical risk level. This is a deliberate fail-safe choice: an administrator can quarantine the file, inspect it, and add a local rule instead of allowing a potentially active format by accident. In production, combine this result with several independent signals. Compare the declared MIME type with magic-byte detection, unpack archives in a restricted scanner, reject password-protected content when it cannot be inspected, scan for malware, and consider whether the sender and business process genuinely require the format. Maintain a narrow allowlist for workflows that accept only images or video, and do not broaden it merely because a file passes this extension check. Also record the normalized suffix and decision so policy changes can be audited. The API price is $0.002 per request, while browser execution can provide the same deterministic result without uploading the filename. Empty extensions are rejected because no meaningful suffix exists to classify.