A winmail.dat arrives when someone sends you mail from Outlook in Rich Text
format and your mail program doesn't speak Outlook's wrapper for it, called TNEF.
The message text comes through; the attachments are packed inside the
winmail.dat. Unpack it, or ask the sender to send it again as HTML.
Two attachments were sent. One winmail.dat arrived.
Save the winmail.dat from the mail, then on Debian or Ubuntu:
sudo apt install tnef
mkdir attachments
tnef -C attachments winmail.dat
It prints nothing and writes the attachments into attachments/. To see what is
inside without unpacking, run tnef -t winmail.dat. On a Mac, brew install tnef
installs the same program.
What is in it
Microsoft documents it in How message format affects email
messages.
A Rich Text message from Outlook carries a plain text version of the body and one
binary attachment, application/ms-tnef, which may hold:
- the formatted version of the text (fonts and colours)
- the ordinary file attachments
- embedded objects, such as pictures pasted into the text
- Outlook features: meeting requests, voting buttons, custom forms
Outlook and Exchange unpack it without you ever seeing it. A mail system that
isn't built on Exchange may not, so you get the text and a file it can't open. Some programs don't recognise the name either and call it
something like ATT00001.DAT. It is the same thing.
Get the attachments out with tnef
tnef is a small, long-lived open source unpacker (GPL). We ran version 1.4.18,
the one in Debian 13, on a test file with two attachments:
$ tnef -t winmail.dat
agenda.txt | agenda.txt
budget.csv | budget.csv
$ mkdir attachments
$ tnef -C attachments winmail.dat
$ ls attachments
agenda.txt budget.csv
The files came out byte for byte. On a real winmail.dat written by Outlook (from
the test data of the ytnef project) it unpacked a JPEG photo and an HTML file,
both of which open normally.
- In your mail program, download the
winmail.dat(orATT00001.DAT) like any attachment. - Run
tnef -t winmail.datto list what is inside. - Run
tnef -C attachments winmail.datto unpack it into a folder. Without-C, the files land in the current folder. - Open the files from that folder.
A few things worth knowing:
- The name doesn't matter. Renamed to
ATT00001.dat, the same file listed and unpacked the same way. - It won't overwrite. Run it twice into the same folder and it says
Could not create file: File existsfor each file and leaves the first copies alone. Add--overwriteif that is what you want. - A file that isn't TNEF stops it with
Seems not to be a TNEF file. - The formatted body is in there too.
tnef --save-body winmail.datwrote amessage.htmlfrom one test file and amessage.rtffrom another, depending on which form the sender's Outlook stored.
Inside WSL (the Ubuntu that Windows can run), the apt commands above are the
same ones. We ran them on Debian, not on a Windows machine.
ytnef, the other one
Debian also packages ytnef (in ytnef-tools). On the same two files,
ytnef -f attachments winmail.dat unpacked the same attachments. tnef is the one
we would reach for: it is in Homebrew as well, and its body option did what it
says on our test files, where ytnef's wrote a file with no name.
| tnef 1.4.18 | ytnef 2.1.2 | |
|---|---|---|
| Debian / Ubuntu package | tnef |
ytnef-tools |
| Homebrew | Yes | No |
| Unpack into a folder | tnef -C dir winmail.dat |
ytnef -f dir winmail.dat |
| Both test files unpacked | Yes | Yes |
| Save the formatted body | --save-body: message.html or message.rtf |
-F wrote an RTF named only .rtf, a hidden file |
What the email viewer shows
If you saved the whole message as an .eml or .msg, the Email
Viewer opens it and lists the winmail.dat as an
attachment, with its size. Click it to download it, then unpack it with tnef.
Drop the winmail.dat itself on the viewer and it refuses it, by name, instead
of showing garbage:
The viewer recognises the file. It does not unpack it.
For an Outlook .msg file, which the viewer does open, see How to open a .msg
file without Outlook. It is a different
file: a whole saved message, not the wrapper around one.
Ask the sender to fix it
If you can't run a command, or the mails keep coming, the fix is on the sender's side. Microsoft's own advice is that ordinary file attachments don't need TNEF, and that mail with attachments for people outside Outlook should go as HTML or plain text.
In classic Outlook for Windows, per Microsoft's article:
- For all mail: File › Options › Mail, then under Compose messages in this format, pick HTML or Plain Text.
- For one message: in the message window, Format Text › HTML or Plain Text.
The new Outlook for Windows offers only HTML and plain text, according to Microsoft's message format page. If a sender on new Outlook or Outlook on the web still sends you winmail.dat, the cause is more likely their organisation's server.
Microsoft says mail from Exchange Online (Microsoft 365) uses TNEF by default,
and that an admin can turn it off for outside domains with
Set-RemoteDomain -TNEFEnabled $false: see How to specify the email message
format used for external
recipients.
That is a request for the sender's IT department, not something they can change
in Outlook. We have not run it.
Even with HTML set, Outlook still uses TNEF when a feature needs it: meeting requests, voting buttons, task requests. So the odd winmail.dat can still turn up on one of those, and tnef unpacks it the same way.
Which to use
- You have a terminal:
tnef -C attachments winmail.dat, and the files are in the folder. - You don't, or you're on a phone: reply and ask for the files again as HTML or plain text. That is the only route that needs nothing from you.
- You're not sure what you have: drop it on the Email Viewer. It says whether it is a message, an Outlook data file or a winmail.dat.
When the attachments are out, open them as you would any other, and delete the
winmail.dat.
