Gmail plus the browser's PDF printer covers both shapes natively, with the attachments quirk deserving its plain statement up front: printing captures the message body and the attachment names only, never the attachment contents, which download separately whatever route you take.

The whole conversation shape: open the thread and click the printer icon at the top right of the conversation area, Gmail's own Print all, which expands every message in the thread into one printable page. The browser's print dialog opens over it, destination set to Save as PDF and the file that results is the full conversation in order, the records shape most audits actually want.

The single message shape: on the specific message, open its three dot menu at the message's top right and choose Print, which renders just that message regardless of how long the thread runs. Same Save as PDF destination, same result minus the siblings. Worth knowing the two icons apart since printing a forty message thread when one message was wanted is this task's classic stumble.

The record keeping refinements: the print render includes the header block, sender, date, subject and recipients, giving the PDF its provenance, filenames deserve a date plus subject convention at the save dialog for the folder to sort itself and attachments per the opening statement download beside the PDF, the pairing kept honest by a records folder per matter rather than loose files. For volume beyond the occasional, Google Takeout exports mail wholesale and the desktop client route through the PST to PDF machinery this forum covers elsewhere industrializes the task properly.