The short answer
- TNEF is an email encapsulation format that packages rich-text message information and attachments, requiring a TNEF-aware client or decoder to display the enclosed content correctly.
- Start with the original email in a client that supports TNEF, such as Outlook. If you only have winmail.dat, use a decoder that explicitly supports TNEF to inspect and extract its contents. On Windows or Mac, check the chosen client's TNEF support rather than relying on the filename association. On a phone, check whether the mail app supports TNEF; if it cannot show the enclosed files, ask the sender to resend ordinary attachments without TNEF. Thunderbird's help describes the LookOut add-on, but Thunderbird does not provide or support it and does not guarantee future compatibility.
- Treat unexpected winmail.dat attachments cautiously. CERT/CC documented a historical TNEF decoding buffer overflow in older Outlook and Exchange versions; this does not establish that all current implementations remain vulnerable. The Microsoft specification warns about address or identity spoofing through attRecipTable and attFrom, so decoded identity fields are not proof of the sender. Microsoft also notes that winmail.dat can expose the sender's PST path and login name, but says this does not expose password information.
TNEF files: open winmail.dat and extract attachments
Microsoft's Transport Neutral Encapsulation Format is supported by Outlook and Exchange. Its binary email attachment is commonly named winmail.dat. A stream contains message-level and attachment-level properties and can carry fonts, colors, OLE objects, Office documents, ordinary attachments, voting buttons and meeting-request information. The opening bytes are 78 9F 3E 22; the DAT extension alone does not establish that a file is TNEF. IANA registers application/vnd.ms-tnef, while Microsoft also documents application/ms-tnef in email.
To recover a document, extract the original attachment from TNEF rather than assuming winmail.dat is itself a PDF or Word file. Any later conversion depends on that document's actual format. When the sender changes message format or disables TNEF, some information may be lost: plain text loses formatting, pictures and links, and features such as voting buttons may become unavailable. Ordinary file attachments do not require TNEF.
How to open it
Start with the original email in a client that supports TNEF, such as Outlook. If you only have winmail.dat, use a decoder that explicitly supports TNEF to inspect and extract its contents. On Windows or Mac, check the chosen client's TNEF support rather than relying on the filename association. On a phone, check whether the mail app supports TNEF; if it cannot show the enclosed files, ask the sender to resend ordinary attachments without TNEF. Thunderbird's help describes the LookOut add-on, but Thunderbird does not provide or support it and does not guarantee future compatibility.
Start with the original email in a client that supports TNEF, such as Outlook. If you only have winmail.dat, use a decoder that explicitly supports TNEF to inspect and extract its contents. On Windows or Mac, check the chosen client's TNEF support rather than relying on the filename association. On a phone, check whether the mail app supports TNEF; if it cannot show the enclosed files, ask the sender to resend ordinary attachments without TNEF. Thunderbird's help describes the LookOut add-on, but Thunderbird does not provide or support it and does not guarantee future compatibility.
To recover a document, extract the original attachment from TNEF rather than assuming winmail.dat is itself a PDF or Word file. Any later conversion depends on that document's actual format. When the sender changes message format or disables TNEF, some information may be lost: plain text loses formatting, pictures and links, and features such as voting buttons may become unavailable. Ordinary file attachments do not require TNEF.
File safety
Treat unexpected winmail.dat attachments cautiously. CERT/CC documented a historical TNEF decoding buffer overflow in older Outlook and Exchange versions; this does not establish that all current implementations remain vulnerable. The Microsoft specification warns about address or identity spoofing through attRecipTable and attFrom, so decoded identity fields are not proof of the sender. Microsoft also notes that winmail.dat can expose the sender's PST path and login name, but says this does not expose password information.
An unknown sender, a name ending in two extensions, or contents that do not match the extension — check before you open it.
Converting it
To recover a document, extract the original attachment from TNEF rather than assuming winmail.dat is itself a PDF or Word file. Any later conversion depends on that document's actual format. When the sender changes message format or disables TNEF, some information may be lost: plain text loses formatting, pictures and links, and features such as voting buttons may become unavailable. Ordinary file attachments do not require TNEF.
Convert a copy, never the original, then compare quality, metadata, and layout against what you started with.
Common questions
What is the TNEF email format, and what is winmail.dat used for?
TNEF packages rich-text email information and attachments for Microsoft email systems. It can preserve Outlook features such as voting buttons and meeting-request information. Its email attachment is commonly called winmail.dat.
How do I open winmail.dat and extract attachments on Windows?
Open the original email in a TNEF-aware client such as Outlook. If you only have the saved winmail.dat file, use a decoder that explicitly supports TNEF to inspect and extract the enclosed attachments.
How do I open winmail.dat on a Mac?
Check whether your Mac email client supports TNEF and open the original message there. If it shows only winmail.dat, use a TNEF decoder or ask the sender to resend the files as ordinary attachments.
How do I open winmail.dat on a phone?
Check your phone's mail app for TNEF support. If it cannot display the enclosed files, ask the sender to resend ordinary attachments without TNEF, or open the message on a computer with a TNEF-aware client.
Why do Outlook attachments become winmail.dat and fail to display?
Outlook may encapsulate attachments and rich-text information in TNEF. A receiving client without TNEF support may show only a plain-text body and winmail.dat. This behavior alone does not prove the original attachments are damaged.
Should I send files as winmail.dat (TNEF) or as ordinary attachments?
Ordinary attachments do not require TNEF and avoid requiring the recipient to decode a TNEF wrapper. TNEF can carry additional Outlook formatting and features, so disabling it can remove features such as voting buttons.
How do I convert winmail.dat to PDF, and what information can be lost?
First decode TNEF and extract the enclosed files. A PDF may already be inside; otherwise conversion depends on the extracted document's format. Changing the email to plain text loses formatting, pictures and links, and disabling TNEF may remove Outlook-specific features.
What security risks can a winmail.dat attachment carry?
TNEF parsing has had documented vulnerabilities in older Outlook and Exchange versions, although that does not prove current implementations share them. Decoded sender fields can also be spoofed. Successful extraction does not establish that the sender or enclosed files are trustworthy.
How can I stop Outlook sending winmail.dat attachments?
Ask the sender to change the outgoing message format or disable TNEF in the applicable Outlook or Exchange settings. The exact controls depend on the setup. Ordinary attachments do not need TNEF, but disabling it can remove voting buttons and other Outlook-specific information.
How can I view winmail.dat attachments in Thunderbird?
Thunderbird's official help describes LookOut, an add-on that decodes winmail.dat and displays the original attachments. Thunderbird does not provide or support the add-on, and its future compatibility is not guaranteed.
Can winmail.dat expose a sender's login name or other private information?
Yes. Microsoft states that winmail.dat may contain the sender's PST file path and login name, which can be viewed with a binary or text editor. The same guidance says password information is not exposed this way.
Related formats
Sources
Microsoft：How message format affects email messages · 格式开发者官方技术支持
Microsoft：[MS-OXTNEF] Transport Neutral Encapsulation Format (TNEF) Data Algorithm · 格式开发者官方规范
IANA Media Types · 互联网媒体类型注册机构
Thunderbird Help：What is the winmail.dat attachment? · 邮件客户端官方帮助
CERT/CC VU#252146：Microsoft Outlook and Microsoft Exchange TNEF decoding buffer overflow · CERT/CC 漏洞协调机构