How to open winmail.dat on a Mac, an iPhone, or anywhere else

Drop the winmail.dat onto SATCHEL. It unpacks the file in your browser tab and lists every attachment that was packed inside, each one savable on its own, along with the formatted body of the email when Outlook put it there. Nothing is uploaded, nothing is installed, and it works the same on a Mac, a Windows PC, an iPhone or an Android phone. Then ask the sender, or their IT person, to change one setting so the next email arrives normally.

What winmail.dat actually is

It is not a virus and it is not a damaged attachment. It is a container in a format Microsoft calls TNEF, for Transport Neutral Encapsulation Format, and it has a mail type of its own, application/ms-tnef. Outlook and Exchange use it to carry things that plain internet email has no place for: the formatting of a message written in Outlook's rich-text mode, the details of a meeting request, and, crucially, the attachments.

Between two copies of Outlook it is invisible. Outlook reads the container and shows the email as it was written. Anywhere else, the mail program sees one attachment with a name it does not recognise and shows you that instead. Apple Mail on a Mac, iPhone and iPad does this, and so, which surprises people, does Outlook for Mac. Microsoft's own support forum has the thread: Outlook for Mac does not open winmail.dat files.

Why it happened to this email

The sender's Outlook sent the message in Rich Text Format to someone outside their organisation, and nothing along the way converted it. Three things can decide that, and the most specific one does not always win:

• The message itself. A reply to an email that was written in rich text is often rich text too, which is why the problem can appear in the middle of a conversation that was fine before.
• The sender's Outlook settings. Outlook has a setting for exactly this case, described below.
• Their mail server. On Exchange and Microsoft 365 an administrator sets, per destination domain, whether TNEF is always used, never used, or left to the sender's Outlook. Microsoft documents that the server setting overrides the user's own.

So the email is not wrong and your mail program is not wrong. Two pieces of software disagree about format, and the file is the result.

Getting the attachments out without installing anything

1. Save the winmail.dat from the email to your computer or phone. On an iPhone, press and hold the attachment and choose Save to Files.
2. Open SATCHEL and drop the file on it, or choose it from Files.
3. Each attachment is listed with its name and size. Save the ones you want. Save every attachment takes them all at once.
4. If you want the whole email as something your mail program can open, choose Save it as an .eml. Apple Mail, Thunderbird and Outlook all open an .eml, attachments included.

The formatted body often comes out too. Outlook stores a rich-text body in a compressed form, and very often that rich text is itself a wrapper around an ordinary HTML email. SATCHEL decompresses it and, when the HTML is inside, recovers the original HTML rather than an approximation of it. Pictures that were sent inside the email are shown. Pictures that live on a server are not fetched, because loading one tells the sender the email was opened.

The usual alternatives, and what each costs

How the sender stops it (send them this)

In Outlook for Windows: File, Options, Mail. Under Compose messages, set the format to HTML. Further down, under Message format, find the line that begins When sending messages in Rich Text format to Internet recipients and set it to Convert to HTML format. That covers replies to old rich-text threads as well as new messages.

On the server, for an administrator: in Exchange Online or Exchange Server, the remote domain setting controls TNEF for everything leaving the organisation. Set-RemoteDomain -Identity Default -TNEFEnabled $false tells Exchange never to use TNEF for outside recipients. Microsoft's documentation lists the three values: $true always uses it, $false never does, and the default, blank, leaves it to each sender's Outlook. Because the server setting overrides the user's, this is the fix that sticks when one person's settings keep coming back.

If the sender is outside your control and none of that happens, the file will keep arriving. Keep the tab bookmarked.

Is it safe to open?

winmail.dat itself is data, not a program, and reading it does not run anything. What is inside it is whatever the sender attached, which is the same question as with any attachment. SATCHEL warns on attachments that run code when opened, such as .exe, .js or a macro-enabled Office file, and on a program whose name has been dressed up to look like a document. TNEF stores a checksum with every part of the file, and each one is checked, so a file that was damaged on the way is flagged rather than handed to you quietly broken.

What it cannot do

• An email encrypted with S/MIME can only be opened with the recipient's private key, which lives in their mail program. It says so rather than guessing.
• It does not change your mail program, so the next winmail.dat from the same sender still arrives as winmail.dat. The fix is on their side.
• If the sender's Outlook sent an Outlook .msg file instead, that is a different format with the same cure: drop it on the same page, and see how to open a .msg file without Outlook.