Preventing TNEF Encapsulation – mxHero Help Center

Microsoft Exchange and Outlook can package a message in TNEF format (Exchange rich text), which other systems see as a single winmail.dat attachment. mxHERO can't see the real attachments inside it, so most rules skip these messages. If you use Microsoft 365 or Exchange, turn TNEF off for outgoing mail before you route mail through mxHERO.

Before you begin

Exchange administrator rights in Microsoft 365, or on your Exchange server.
If you use the Office 365 Configuration Service, it already sets the default remote domain to never use TNEF. Use the steps under Verify below to confirm.

How TNEF affects rules

Rule action	What happens to a TNEF message
Protect Attachments, Secure Email, Zip Attachments, S/MIME	Skipped. The message is delivered unchanged.
Block Attachments, Request Approval, Temporary Hold	Skipped by default. You can make these rules match TNEF messages with the Include TNEF messages option in the attachment filter. The whole message then matches.
Copy Emails	The message is saved, but its attachments stay inside `winmail.dat`.

Email Flow Logs flag TNEF messages, and the skip reason mail_content_is_tnef appears when a rule skips one.

Turn off TNEF in Microsoft 365

Remote domain settings control the format Exchange uses for mail to other domains. Set the Default remote domain, which covers all domains without their own entry.

Using Exchange Online PowerShell

Connect to Exchange Online PowerShell.

Run:

Set-RemoteDomain Default -TNEFEnabled $false

If you have other remote domain entries, check them too:
```
Get-RemoteDomain | Select-Object Name, DomainName, TNEFEnabled
```
Set any entry that shows True or is empty in the same way, using its name instead of Default.

Using the Exchange admin center

Open the Exchange admin center and go to Mail flow › Remote domains.
Select Default, then edit its Text and character set settings.
Set Use rich-text format to Never, and save.
Repeat for every other remote domain listed.

Note: If your organization added remote domain entries for its own domains, set those to Never too. Mail that mxHERO returns to your tenant is otherwise formatted by those entries.

Turn off TNEF in Exchange Server

On Exchange Server 2013 or later, run the same commands in the Exchange Management Shell:

Get-RemoteDomain | Set-RemoteDomain -TNEFEnabled $false

Verify

Run:

Get-RemoteDomain | Select-Object Name, TNEFEnabled

Every entry should show False.

From Outlook, send a rich-text message with an attachment to a test recipient covered by a rule.
In Reports › Email Flow Logs, open the message. The rule should have run, and the TNEF flag should be off.

Changes to remote domains can take some time to apply across Microsoft 365.

Troubleshooting

Symptom	Cause	Fix
Recipients get `winmail.dat` instead of attachments, and rules didn't run	TNEF still enabled on a remote domain	Check every remote domain entry, not only Default.
Email Flow Logs show `mail_content_is_tnef` for some senders only	Those senders use Outlook's rich-text format, and a remote domain entry still allows TNEF	Set all entries to never use TNEF. Asking users to send in HTML also avoids it.
Block or hold rules don't catch TNEF messages	The rule's attachment filter doesn't include TNEF	Turn on Include TNEF messages in the rule's attachment filter. See Filters and exclusions.