Why does my email contain a winmail.dat? – Hornetsecurity KnowledgeBase

Some emails may include the email attachment "winmail.dat". In the following article, you will learn what winmail.dat is, why it is attached, and how to prevent it.

Problem

When a Microsoft Outlook user sends an email, it may include the attachment "winmail.dat" along with the actual message text for the recipient. This attachment often cannot be opened or interpreted by the recipient.

Cause

This behavior occurs when an email is sent via a Microsoft Exchange Server in Rich Text Format (RTF). In this case, the email's formatting information is transmitted in the proprietary TNEF (Transport Neutral Encapsulation Format). Since this is a Microsoft-specific format, recipients without Outlook cannot process it.

Solution for the sender

The cause lies on the sender's side, so this is the most effective place to resolve the issue.

Option 1: Change message format (individual user)

As long as emails are sent in "HTML" or "Plain Text" format, this behavior does not occur. Outlook users can change the message format from RTF to HTML. Microsoft describes how to do this in the following guide: Change message format in Outlook

Option 2: Disable TNEF via PowerShell (entire domain)

You can disable the TNEF format using a PowerShell command. This will prevent all emails from being sent in TNEF format. Please note that this will disable TNEF for all O365 users.

Set-RemoteDomain -Identity <domain.tld> -TNEFEnabled $false

Option 3: Disable TNEF via the Microsoft 365 Admin Center (entire domain)

Sign in to the Microsoft 365 Admin Center.
Open the Mail flow section.
Select Remote domains.
Open the remote domain Default or the desired remote domain.
Under Use rich-text format, select the option Never.
Save the changes.

Important: Options 2 and 3 affect all users of the affected domain, not just individual mailboxes. TNEF will be disabled for all emails to this remote domain, preventing the creation of winmail.dat files.

Solution for the recipient

If no Exchange Server is used or no change can be made on the sender's side, you have the following options to open the attachment:

Use a free local tool like Winmail Opener for Windows.
Use an online tool to analyze and extract the attachment.
Use the MDaemon Email Server, which offers a built-in feature to process winmail.dat attachments. To enable this, follow this article: Extract attachments from winmail.dat (MDaemon)