Many senders have concerns about sending bulk email with PDF attachments. ESPs often advise customers against doing so and suggest alternate solutions like linking to a web portal that has the PDF file. This is all very sensible.

But what happens if you must send an PDF attachment due to a regulatory or some other mandatory requirement - is the campaign guaranteed to fail?

The answer is no. It is possible to send a PDF attachment as part of a bulk campaign and give it a very good chance of reaching inboxes.

To understand how, you need to understand what a PDF really is.

What is a PDF?

The Portable Document Format dates back to 1993 when it was created by Adobe (then known as Adobe Systems). It became an ISO standard in 2008.

PDF files contain everything needed to represent a document such as fonts and images. But they can also include multi-media and executable content along with interactive elements such as forms that can be connected to an internet-hosted resource.

Historically the format’s versatility, vulnerabilities in the most common PDF reader, and how common email clients handled PDFs caused them to be treated with suspicion by message filters. At one point viruses were being embedded in PDF attachment as a way to avoid traditional defences.

While the security and email landscape has changed, the interactive and executable capabilities of PDFs can still paint a target on them when they are part of a bulk campaign.

Use PDF/A

PDF has a number of spin-off sub-formats intended for specific purposes. One of these formats is PDF/A which is intended for archiving information. Conveniently this format also does not support the majority of elements which message scanners tend to find objectionable.

Using the PDF/A format for attachments in your breach notifications or mandated communications will give them the best chance of not being unfairly targeted. This tactic works not because filters give PDF/A an automatic pass, but because it will prevent you from accidentally including some potentially objectionable embedded content when creating the PDF.

Of course there are many other best practices around mandated communications, but that will be a separate post.