Separate four limits before choosing a mail plan
An attachment limit is not the same as mailbox storage. A single outgoing message can be refused because its encoded size is too large, even when the sender has gigabytes of unused storage. An incoming message can fail because the recipient's server rejects its size, while a smaller message can fail because the recipient mailbox is full. These are different checkpoints with different remedies.
A useful requirements sheet has four fields: maximum outgoing message, maximum incoming message, storage allocated to each mailbox, and storage available to the wider hosting account. Ask who controls each setting and whether the published number applies to a file, all attachments together, or the entire transmitted message. A plan headline alone rarely answers every question.
Understand why a file grows inside email
Email attachments are packaged using MIME so that different mail systems can transport binary content. Base64 encoding represents groups of binary bytes as printable characters; this adds overhead before message headers and multipart boundaries are counted. A document that appears to be comfortably below a provider's message limit on disk may therefore exceed the limit after packaging. RFC 2045 defines the relevant encoding mechanism.
Do not promise that a nominal twenty-megabyte file will pass through every service with a twenty-megabyte message ceiling. Allow headroom for encoding and the body, and remember that multiple attachments add together. Compression may help a suitable file type, but compressed photographs and videos often shrink little. A link to an access-controlled file may be a better design than squeezing a borderline message through.
The receiving system can be the stricter side
A sender may be allowed to compose a large message yet receive a rejection from the destination domain. The destination's mail gateway, security policy, mailbox configuration and client application can impose separate restrictions. Successful delivery to one colleague on the same platform does not prove that the identical attachment will reach an external customer. Internal and external mail paths can behave differently.
For a business exchanging drawings or quotations with many organisations, test with an authorised external recipient before promising a delivery method. Ask the recipient for their approved secure-transfer channel when a large attachment repeatedly fails. Record the approximate encoded message size and error text, not the confidential file contents. Do not attempt to bypass the recipient's security rules by disguising file types or splitting prohibited content.
Read Gmail and Exchange figures in context
Google's Gmail Help states a twenty-five-megabyte attachment limit for personal Gmail accounts, while work and school account limits depend on their Workspace administrator. Google's interface can substitute a Drive link when the attachment total exceeds its limit. That behaviour does not establish the receiving customer's permission to open the link, and it is not a universal OnHypp hosting specification.
Microsoft's Exchange Online service description distinguishes default sending and receiving message sizes, administrator-configured ceilings, client differences and additional encoding overhead for messages leaving Microsoft's environment. It also distinguishes individual attachment limits from total message limits. Instead of copying the largest figure from a vendor table into a quotation, verify the customer's exact subscription, client, organisational policy and destination. Numbers can change with provider configuration.
Check the actual cPanel mailbox allocation
On a compatible cPanel service, Manage Email Accounts exposes the current storage use and allocated storage space for individual mailboxes. A mailbox that reaches its enforced quota may reject new mail and return a full-mailbox error. The administrator or hosting provider can control available quota options. The existence of an 'unlimited' interface option must not be confused with unlimited physical server capacity.
Check the affected address rather than relying on a package-wide estimate. Compare its allocation, current usage and the hosting account's available space. If a user reports missed invoices, ask for the exact non-sensitive delivery failure notice and check whether it says quota exceeded. Changing an attachment policy will not resolve a full mailbox. Likewise, deleting a few messages may not overcome a strict per-message gateway ceiling.
Inspect which folders consume storage
Mailbox size is affected by more than Inbox. Sent items can retain another copy of every outbound attachment, while drafts, spam, archived folders and local-client synchronisation can complicate what staff think is stored. cPanel's Email Disk Usage interface can display folders, message counts and disk consumption, although reported figures may lag because of caching. The host can disable the interface.
Compare folder usage for the actual address before making changes. A sales employee who sends the same product catalogue to twenty customers may use considerable Sent storage even when the Inbox looks empty. Establish whether the mail client stores copies on the server and whether another device retains an offline copy. Never infer that clearing a visible desktop folder removes every server copy, or that a deleted message has disappeared from backups.
Estimate growth with a concrete workload
Consider a hypothetical design studio that sends six proof files of eight megabytes each on a busy day. If separate outgoing messages are retained in Sent, those files alone represent forty-eight megabytes of original attachment content before MIME overhead, message bodies and replies. Over twenty working days, that is roughly nine hundred and sixty megabytes of file content, not a guaranteed measurement of server disk use.
The example is a planning calculation, not an OnHypp quota or a universal mail-storage formula. Actual use depends on compression, deduplication, server handling, retention, incoming attachments and how staff share files. Ask the team to sample several representative weeks, record storage changes and identify peak periods. A realistic forecast should include a buffer for urgent client files rather than assuming every month looks like the quietest one.
Avoid sending the same heavy file repeatedly
Repeatedly attaching the latest price list or product drawing creates multiple copies in different mailboxes and can make version control difficult. One customer may act on an older attachment after a revised file was issued. A central, access-controlled file location can reduce duplication and make the approved version easier to identify. It also changes the workflow: the recipient needs permission and a working link.
Decide whether a file is a fixed record that should remain attached to a particular business transaction or a collaborative document that may be revised. For a signed quotation or formal approval, preserve an appropriate immutable record under the company's retention policy. For a working design proof, use a versioned repository and state which version the recipient should review. Storage efficiency must not erase evidence the business is obliged to keep.
Choose a secure file-sharing alternative
For files that exceed mail limits, a managed file-sharing service may be more suitable than an attachment. Choose a service already approved by the business and assess where data is stored, who administers the workspace, whether access can be revoked, and whether recipients must sign in. A cloud link is not automatically private merely because it is long or difficult to guess.
Microsoft's SharePoint and OneDrive guidance distinguishes links for specific people, organisation members and anyone with the link. These choices have materially different exposure. The business should normally favour the narrowest permission that lets the intended customer complete the task, subject to its approved policy. If an external recipient cannot use the chosen service, agree an authorised alternative rather than quietly enabling anonymous access.
Set link permissions and expiry deliberately
Before sharing, check whether the recipient may view, download, edit or reshare the file. A view-only link can still permit downloads in some products unless an additional restriction is available and enabled. Link expiry may reduce exposure after a project ends, but it does not recall copies that someone already downloaded. Microsoft documents that expiry of a sharing link does not delete the underlying file or revoke other independent permissions.
For a hypothetical quotation review, a named-recipient link with a reasonable expiry may be appropriate. For a collaborative drawing, editing rights should be limited to the named project team. Test access using an authorised recipient account rather than the owner's already-signed-in browser, which may hide permission problems. Record the file owner and a procedure for withdrawing access when the engagement finishes.
Prepare files before handing them to customers
File hygiene matters whether the delivery method is email or a link. Use descriptive filenames that include the project and version without exposing unnecessary personal data. Check that the document opens correctly, that tracked changes and hidden comments are handled appropriately, and that an export does not reveal unrelated worksheets or internal notes. A PDF may be easier to review than an editable source file when the recipient only needs to approve a quotation.
Separate working masters from customer deliverables. For example, retain the editable design source under internal controls and share only the approved proof. If several attachments belong to one request, include a short inventory in the message so the customer can verify completeness. Do not claim that changing a filename or converting a document to PDF makes the content secure or removes every embedded metadata field.
Design an inbound-file intake process
Businesses also receive large files. A public enquiries address may be inappropriate for high-volume photos, scanned documents or technical drawings. Decide which inbox should receive ordinary questions and which approved upload channel should handle files. The upload channel needs access controls, an owner, retention rules and a way to confirm that the correct project received the correct version.
Do not invite customers to send identity documents, payment-card data or passwords to a general mailbox merely because attaching a file is convenient. Where sensitive records are genuinely necessary, use the organisation's authorised collection method and applicable privacy notices. Staff should know how to recognise a failed upload, avoid duplicate submissions and confirm receipt without echoing confidential content into an automated email.
Diagnose a rejected attachment without guessing
A delivery-status notification can contain a server response, recipient address and diagnostic text. Preserve a redacted copy of the relevant error rather than forwarding a whole confidential thread to multiple technicians. An error mentioning message size points to a different investigation from one mentioning mailbox quota, a blocked file type or a temporary server problem. Error wording and codes vary across mail systems.
First determine whether the sender's application refused the file before submission, the sending server rejected it, or a remote server returned a failure. Then reproduce with an authorised harmless test file of known size and record the time, client and destination. If only one recipient fails, compare that destination's stated policy. If every recipient fails, inspect the sender's configured limits and available space before changing DNS or unrelated mail settings.
Test both directions with representative files
A sensible acceptance test covers sending and receiving, not just a successful Compose screen. Use an authorised internal account and an external test recipient, with synthetic files below the expected limit and another near the boundary. Confirm the delivered message opens, the attachment remains intact and the recipient can reply. Do not send confidential customer material merely to test a size threshold.
Record what passed, what failed and which system reported the result. A large file that appears in Sent does not prove remote delivery. Likewise, a message accepted by the destination server does not prove a human opened the document. If an access-controlled link is used, test from a clean recipient session and verify the permission prompt. Recheck after material provider changes, migration or a new security policy.
Account for phones, offline copies and synchronisation
A user may see a large attachment on a laptop but not on a phone because the mobile client has a download policy, poor connectivity or insufficient device storage. That is not automatically a mail-server attachment rejection. Distinguish a message that never arrived from a message that arrived but whose file was not downloaded. Check the same mailbox through approved Webmail or another supported client.
For staff working from job sites, agree when they should use a secure link rather than download a large file over mobile data. Consider whether cached documents remain on lost devices, whether device locks are enforced and how company access is removed after an employee leaves. Mailbox quota and phone storage are independent resources; clearing a phone's cache does not necessarily reduce the server's mailbox usage.
Make retention decisions before deleting messages
Deleting the largest messages may quickly reduce visible usage, but those messages could contain signed instructions, contractual evidence, customer approvals or records needed for a dispute. Set retention categories before bulk deletion. An old promotional attachment and a formal acceptance of work should not automatically receive the same treatment. The relevant period depends on applicable law, contract, company policy and the record type.
cPanel's Email Disk Usage interface includes tools for selecting messages by age or size and deleting them permanently. That is a potentially destructive operation, not a harmless optimisation. Have an authorised owner review the scope, verify the backup and document what was removed. If retention obligations are unclear, preserve the records and seek appropriate advice instead of running a broad clean-up query.
Do not confuse an archive with a verified backup
Moving messages into an archive folder may reorganise the inbox without reducing server storage at all. Exporting mail to a local file can create a separate copy, but a file that has never been restored is not proof of recoverability. Decide which records must remain searchable, which can move to approved long-term storage and who is permitted to restore them. Keep confidential records under access control.
A backup plan should identify the mailbox, covered folders, schedule, retention, encryption, recovery owner and restoration test. For a small business, the most useful question is not simply whether the host advertises backups, but whether a particular required message can be recovered within an acceptable time. Confirm scope and recovery terms with the actual provider; do not assume a website-file backup also contains complete mailboxes.
Apply security checks to files and links
An attachment can carry malware or a deceptive filename, while a shared link can lead to a fake sign-in page. Train staff to verify unexpected requests through an independent known contact method, especially when a message urges urgent payment or asks them to enable macros. File size is not a measure of trustworthiness. A small document can be dangerous, and a large approved drawing can be legitimate.
Use the organisation's approved endpoint protection, email filtering and access policies. Do not disable scanning or rename blocked executable files to force delivery. For customer-facing workflows, tell recipients what file they should expect and from which verified address or service. When a suspicious file arrives, follow the company's incident process rather than distributing it among colleagues for informal inspection.
Assign ownership of capacity and permissions
Mailbox housekeeping fails when everyone assumes someone else is watching. Assign one administrator to review quotas and provider notices, a business owner to approve retention rules, and a designated person to manage shared-file permissions. The administrator should not independently decide to delete customer evidence merely because a mailbox is nearly full. Define escalation before a busy period.
Keep a simple register of business-critical addresses, their responsible users, allocated space, observed growth, warning thresholds and approved transfer method for large files. Review it when staff roles change or a new customer contract increases document volume. Alerts are useful only if they reach a monitored address and someone has authority to act. Document an alternative contact channel for urgent correspondence when email delivery is disrupted.
Know when a storage upgrade is justified
An upgrade is appropriate when measured demand, retention requirements and forecast growth exceed a service's usable allocation after reasonable housekeeping. It is not automatically the answer to a rejected forty-megabyte attachment: the message-size ceiling may remain unchanged even if mailbox capacity doubles. Conversely, a team that rarely sends large files can still need more mailbox space because it must retain years of legitimate correspondence.
Before requesting a quotation, list active mailbox count, current allocations, usage trend, attachment patterns, approved retention period, required recovery capability and expected growth. Ask the provider to confirm whether any proposed change affects storage, message limits, both or neither. Verify taxes, renewal terms and migration work separately against an approved written offer. Do not invent an OnHypp upgrade price or promise a capacity that has not been confirmed.
Answer three common customer questions
Can I send a large file if my mailbox has plenty of free space? Not necessarily: available storage and maximum message size are independent. Will a sent email always be received? No; a sender's Sent folder proves only what that client recorded, not successful acceptance by every remote server. Can I solve a full mailbox by moving messages to an Archive folder? Only if the archive actually moves content out of the constrained storage location.
What should the business do first? Identify the failing step using a non-sensitive test, check current provider documentation and inspect real quota usage. If a secure link is used, test the recipient's permission and keep the transaction record that the business needs. These answers are operational guidance, not a substitute for a provider-specific diagnosis or a retention decision by an authorised owner.
A practical review before the next busy month
Start with one critical mailbox rather than changing every account at once. Record its allocated quota, current usage and busiest folders. Identify the largest recurring attachment workflow and the customers who receive those files. Confirm sending and receiving size policies from the actual providers, then run a harmless test in both directions. Decide whether the workflow belongs in email or a permission-controlled file service.
Finish by naming who monitors usage, who approves deletion and who can contact the provider when delivery fails. Write down how staff will inform a customer if a file is unavailable and how they will revoke a shared link after completion. Revisit the decision after collecting actual usage data. The desired outcome is reliable delivery and appropriate records control, not simply the largest advertised storage number.
Mailbox capacity is a different budget from application storage
A company may need more space for engineering drawings attached to emails while its website uses almost no CPU. List mailbox users, actual current sizes, retention rules and suspicious forwarding or account-access incidents separately from the capacity requirements of the company's website. Ask the email administrator whether large attachments belong in a controlled file-sharing system and verify permissions before sending customer records.
OnHypp's existing Biz and Power offers remain the normal starting point for professional mailboxes. Both optional annual hosting prices include one qualifying domain allowance up to RM100, but that domain entitlement should not be confused with mailbox storage. Request the relevant email-storage upgrade when the email system is the actual bottleneck.
Sources & further reading
- cPanel: Manage Email Accounts and Storage
- cPanel: Email Disk Usage
- cPanel: Disk Usage
- cPanel: Exim Configuration Manager
- Google Gmail Help: Send attachments
- Microsoft Learn: Exchange Online limits
- Microsoft Learn: Sharing links in OneDrive and SharePoint
- Microsoft Learn: Plan sharing and collaboration
- RFC Editor: RFC 2045 MIME