diff --git a/cmd/md2pq/md2pq.go b/cmd/md2pq/md2pq.go
index a2649b3..3396966 100644
--- a/cmd/md2pq/md2pq.go
+++ b/cmd/md2pq/md2pq.go
@@ -7,6 +7,7 @@ import (
 	"expvar"
 	"flag"
 	"fmt"
+	"io"
 	"io/ioutil"
 	"os"
 	"path/filepath"
@@ -36,7 +37,12 @@ var (
 	dupCnt = expvar.NewInt("duplicates-found")
 )
 
-var CRCR = []byte("\n\n")
+var (
+	CRCR = []byte("\n\n")
+	// Maximum bytes we parse when decoding
+	// email message, 50MB.
+	maxMessageSize int64 = 50 << 20
+)
 
 func Load(db *sql.DB, uid int, root string, skip *set.StringSet) error {
 	dup := set.NewStrings()
@@ -89,7 +95,7 @@ func Load(db *sql.DB, uid int, root string, skip *set.StringSet) error {
 			}
 			defer r.Close()
 
-			b, err := ioutil.ReadAll(r)
+			b, err := ioutil.ReadAll(&io.LimitedReader{R: r, N: maxMessageSize})
 			if err != nil {
 				return err
 			}