RoundCube fails to display emails with large attachments because PHP and IIS enforce strict upload limits that truncate or block the request before RoundCube can process the message. To resolve this, you must increase the
post_max_size and
upload_max_filesize directives in your
php.ini configuration file to exceed the size of the largest expected attachment. Additionally, ensure that IIS web server settings allow sufficiently large requests by updating the
maxAllowedContentLength attribute in your
web.config file.
Understanding the Limiting Factors
When an email client like RoundCube attempts to load a message containing a large attachment, the data travels from the mail server through the web server (IIS) and into the PHP runtime environment. Each layer has its own security and performance thresholds. If any single layer rejects the payload due to size constraints, the user sees a blank page, a timeout error, or simply does not see the attachment link in the interface. This is rarely a bug within RoundCube itself but rather a configuration mismatch between the application expectations and the server capabilities.
The most common culprit is the PHP configuration. By default, many hosting environments set conservative limits to prevent resource exhaustion. However, for business or personal use cases involving media files, archives, or large documents, these defaults are often too restrictive. The second major factor is the Internet Information Services (IIS) module responsible for handling HTTP requests. IIS acts as a gateway, and if it blocks the incoming stream based on content length, PHP never even receives the full request body to parse.
Configuring PHP Limits Correctly
You need to modify the active
php.ini file used by your IIS installation. Locate this file using the path specified in your server documentation or by creating a temporary
phpinfo() script to identify the loaded configuration file path. Open the file in a text editor with administrative privileges.
Search for the following directives and update them to values higher than your target attachment size. It is critical to understand that these values must be expressed in bytes or specific suffixes, not arbitrary strings.
upload_max_filesize: This controls the maximum size of individual uploaded files. Set this to at least 10MB larger than your largest expected attachment.post_max_size: This controls the maximum size of the entire POST request. Since attachments are sent via POST, this value must be greater than upload_max_filesize. A good rule of thumb is to set this to roughly 1.5 times the upload_max_filesize.
For example, if you want to support 50MB attachments, you might set:
upload_max_filesize = 50M
post_max_size = 60M
Note that some older or misconfigured guides suggest using raw byte integers without units, which can lead to confusion. Modern PHP versions accept suffixes like 'M' for megabytes and 'G' for gigabytes. Ensure there are no comments (# or ;) preceding these lines that would disable them. After saving the file, you must restart the PHP service or the IIS worker processes for changes to take effect. Simply reloading the webpage will not apply new PHP ini settings.
Adjusting IIS Web Server Settings
Even if PHP allows large uploads, IIS may reject the request at the HTTP protocol level. IIS uses the
<requestFiltering> section in the
web.config file to limit request sizes. If this limit is lower than your PHP limits, the request will fail with a 404.13 or 404.12 error, or appear as a silent failure in RoundCube.
Navigate to the root directory of your RoundCube installation or the site configuration folder. Open the
web.config file. Look for the
<security> >
<requestFiltering> node. You need to add or modify the
<requestLimits> element to include the
maxAllowedContentLength attribute. This value must be specified in bytes.
To calculate the byte value, multiply your desired megabyte limit by 1,048,576 (1024 * 1024). For a 50MB limit, the calculation is 50 * 1048576 = 52,428,800 bytes. Your configuration should look like this:
<configuration>
<system.webServer>
<security>
<requestFiltering>
<requestLimits maxAllowedContentLength="52428800" />
</requestFiltering>
</security>
</system.webServer>
</configuration>
If the
<requestLimits> tag already exists, simply update the
maxAllowedContentLength attribute. Do not use string formats like "50M" here; IIS strictly requires integer byte values. Save the
web.config file and recycle the application pool associated with your RoundCube site to ensure the new filter rules are loaded.
Verifying the Configuration
After applying both PHP and IIS changes, verify that the new limits are active. Create a simple PHP script named
test_limits.php in your RoundCube directory with the following content:
<?php
phpinfo();
?>
Access this file via your browser and search for "upload_max_filesize" and "post_max_size". Confirm they reflect your updated values. While
phpinfo does not directly show IIS limits, you can test the functionality by attempting to upload a file slightly smaller than your new limit through RoundCube's webmail interface. If the attachment appears correctly, the issue is resolved. If you continue to experience issues, check the IIS logs for HTTP status codes indicating rejection, such as 404.13, which points back to the
web.config setting being insufficient or incorrectly formatted.
For more advanced server management tasks, you might find it useful to explore how to manage application structures effectively. See
How to Add a New Folder to Yii2 with Nginx for insights on organizing web application resources, which shares similar principles regarding server configuration hierarchy.
Frequently Asked Questions
Why do I get a 404.13 error after changing php.ini?
This error indicates that IIS rejected the request before passing it to PHP. It means your
web.config maxAllowedContentLength is still too low. You must increase this byte-value limit in the IIS configuration to match or exceed your PHP settings.
Does restarting IIS clear the cache for these settings?
Yes, recycling the application pool or restarting the IIS service is required for both
php.ini and
web.config changes to take effect immediately. Without a restart, the server continues to use the previously cached configuration values.
Can I set different limits for different users in RoundCube?
No, these limits are enforced at the server level by PHP and IIS, not within the RoundCube application logic. All users accessing the same site instance share the same upload capacity constraints defined in the global configuration files.
What happens if post_max_size is smaller than upload_max_filesize?
PHP will fail to process the request entirely, often resulting in empty $_POST arrays or a fatal error. The
post_max_size must always be greater than
upload_max_filesize to accommodate the file data plus other form fields sent in the same request.
Is there a security risk in increasing these limits significantly?
Yes, allowing extremely large uploads can lead to denial-of-service attacks or disk space exhaustion. Always balance usability with server health, and consider implementing additional validation scripts or rate limiting if you expose your webmail to untrusted networks.