> For the complete documentation index, see [llms.txt](https://docs.material.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.material.security/learn-more/risk-areas/email-threats/investigate/issue-details/blocked-attachments.md). # Blocked attachments outside an active issue When Material remediates a malicious email, it replaces the original attachment with a stub — a placeholder that alerts recipients the content has been secured. In most cases, this happens within an active issue that admins can find and act on in [Issue Details](/learn-more/risk-areas/email-threats/investigate/issue-details.md). Occasionally, a recipient reports an inaccessible attachment in a message that has **no visible issue attached to that message**. The original message in the thread may still belong to a parent issue. This page explains the most common causes and how to resolve them. *** ## Why this happens
The message is part of a thread where the original was remediated When Material remediates a malicious email, it replaces the original attachment with a stub. If that email later becomes part of a thread — for example, a colleague replies to or forwards the original message internally — the stub travels with it. Recipients of those later messages inherit the blocked attachment even though their message was never independently flagged and will not appear in an active issue. This is the most common cause of blocked attachments outside an issue.
The attachment hash matched a previously flagged file Material uses attachment hash matching to identify files that have appeared in known malicious messages. If an attachment's hash matches one from a previously flagged issue, Material may block it in subsequent messages — even ones from senders who are not under any active issue. {% hint style="warning" %} **Trusted entity status does not override attachment hash blocking.** A message from a trusted domain can still have its attachment blocked if the attachment's hash matches a previously flagged file. {% endhint %} If you believe this is the cause, contact Material Support. Hash-level overrides require escalation and are not available in the admin UI.
*** ## How to investigate and release 1. **Find the affected message in Message Explorer** 1. Open [Message Explorer](/learn-more/risk-areas/email-threats/investigate/email-threat-issue-search.md). Search by recipient, subject, or message ID. 2. Open the message and review the full thread. Look for the **earliest message** in the thread. That message is usually the one tied to the parent issue.
3. If you know the attachment hash, search for `message.attachments.hash` to find every message that contains that file. 2. **Open the parent issue** 1. From the original message, open the linked parent issue. 2. Review the issue context in [Issue Details](/learn-more/risk-areas/email-threats/investigate/issue-details.md) and inspect the message history in [Detected and similar messages](/learn-more/risk-areas/email-threats/investigate/issue-details/detected-and-similar-messages.md). The internal recipient's copied or forwarded message may not appear in the issue. That is expected. The parent issue tracks the original flagged message, not every downstream thread copy. 3. **Classify and restore if the file is safe** If the parent issue is a false positive, or if you confirm the attachment is safe, update the issue in [Response and Remediation](/learn-more/risk-areas/email-threats/investigate/issue-details/response-and-remediation.md). Set the classification to **Safe** and the response to **Restore**. This restores the original attachment for affected recipients.

Only admins with access to the parent issue can take this action. The recipient of the copied or forwarded message will not see the issue on their end.

*** ## If no parent issue exists If you've traced the thread and cannot find a parent issue — for example, the block appears to be a pure hash match with no related active issue — contact Material Support with the affected **message ID**. To get the message ID: 1. Find the message in [Message Explorer](/learn-more/risk-areas/email-threats/investigate/email-threat-issue-search.md) or from within an issue. 2. Click the message row to open **Message Details**. 3. Click **All Actions** (or `⌘K`) → **Copy Message ID**.
Message Details All Actions menu showing the Copy Message ID option.

Copy the message ID from Message Details.

Share the message ID with Support so they can investigate the hash match and apply an override if appropriate. For support access details, see [Support Settings](/learn-more/risk-areas/email-threats/support-settings.md). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.material.security/learn-more/risk-areas/email-threats/investigate/issue-details/blocked-attachments.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.