Does Gmail scan for viruses?

Last reviewed: October 1, 2026 · Markdown version

Yes. Google's anti-virus page puts it in one sentence: "Attachments in Gmail messages you send and receive are automatically scanned for viruses" (Anti-virus scanning attachments, read 1 October 2026). That covers both directions and needs no setting. What happens when the scanner finds something, on either side, is on are Gmail attachments secure?; this page is about the edges of the scan, which are where the risk actually sits.

Files the scanner cannot look inside

Google's attachments page lists three reasons Gmail may label an attachment suspicious instead of clearing it. The one that matters most: "Some attachments, like documents that require a password to open, are encrypted and can't be scanned for viruses." The other two are attachments that allow "unverified scripts", and forwarded emails attached as .eml files, where Gmail checks the contents but "can't confirm that the sender in the .eml files actually sent those emails" (Open & download attachments in Gmail, read 1 October 2026).

Google's advice on the same page is short: "If the email looks suspicious, don't reply and don't download the attachment." It also says the opposite case plainly: "If the email is from someone you know and trust, ignore the warning." A password-protected file from a colleague who told you the password is the expected case; the same file from a stranger, with the password in the email body, is the classic way past a scanner.

Links are a separate check

An attachment scan does nothing about a link in the message text. Google handles links differently: it "adds link protection for all official Gmail clients (web, Android, and iPhone & iPad)". If you read your Gmail in another app such as Apple Mail or Outlook, the same page describes the protection there as "a small test" for some users (Click-time link protections in third-party email clients, read 1 October 2026). So the app you read mail in can change how much checking a link gets before you open it.

Phishing is a third mechanism again. Google says Gmail "is designed to help protect your account by automatically identifying phishing emails", and that a suspected one may get "a warning" or be moved "to Spam" (Avoid & report phishing emails, read 1 October 2026). A message can pass the virus scan and still be a phishing email: the scan looks at files, not at what the message is asking you to do.

What Google does not tell you

The anti-virus page says nothing about how the scanning works: no engine, no update schedule, no detection rate. Its wording is that Gmail rejects mail when it finds "a known virus"; it makes no claim about threats that are not yet known (Anti-virus scanning attachments, read 1 October 2026). We are not going to fill that gap with a guess. The practical reading is that the scan is a strong net, not a guarantee.

What that means for you

A clean scan is not a verdict on the sender. Check who sent it before you open anything that asks you to sign in or pay.
Treat a password-protected archive from someone unexpected as unscanned, because it is.
Some files never arrive at all. Gmail refuses certain file types outright; that list, and why zipping does not get around it, is on does Gmail block certain emails?