Microsoft Outlook uses the proprietary TNEF format to send attachments. With non-Microsoft email clients you will see the infamous winmail.dat attachment, which generally remains as a black box that you cannot open.

Here I explain a recipe to filter such mails at Local Delivery Agent stage, i. e. the mail is filtered before it arrives into the user mailbox, the MIME part of type Application/MS-TNEF is parsed and every file contained herein, is attached again as a standard MIME part.

The original TNEF attachment is retained, so the size of the email is roughly doubled.

I'm running a mail server based on Debian 10 Buster, the IMAP, POP3 and LDA services are provided by Dovecot. The Local Delivery Agent have the Sieve filtering enabled. You can read the configuration details in this article: Sieve filtering with Dovecot.

First of all we need a mail filter program which does all the magic. It will receive the mail message as standard input and it will produce the converted message to the standard output.

You can download the tnef-filter script written by Graham Edgecombe, from his GitHub repository. I copied the binary script into /usr/local/bin/tnef-filter.

Running the script on my Debian 10 Buster server, requied the following libraries:

apt-get install libconvert-tnef-perl libfile-mmagic-perl libmime-tools-perl

In my installation, each user have a file called $HOME/sieve_before.d/personal.sieve, this is a file where I put antispam and antivirus filters, that the user is not allowed to customize. Feel free to add the Sieve filter rule in whichever file suits your needs.

require ["fileinto", "vnd.dovecot.filter", "mime", "foreverypart"];

# Filter with /usr/local/lib/dovecot/sieve-filter/tnef-filter.sh
# if there is an attachment of type Application/MS-TNEF (e.g. winmail.dat).
foreverypart
{
    if header :mime :anychild :contenttype "Content-Type" "application/ms-tnef"
    {
        filter "tnef-filter.sh";
    }
}

Notice that you need to include the mime and foreverypart plugins.

I created the shell script tnef-filter.sh into the /usr/local/lib/dovecot/sieve-filter/ directory; it is a simple one-line command:

#!/bin/sh
/usr/local/bin/tnef-filter

The directory is the one declared to contains Sieve filters. You can set that location into /etc/dovecot/conf.d/90-sieve-extprograms.conf:

plugin {
    sieve_filter_bin_dir = /usr/local/lib/dovecot/sieve-filter
}