====== Filtering TNEF (winmail.dat) attachments with Sieve ======

Microsoft Outlook uses the proprietary **[[wp>Transport_Neutral_Encapsulation_Format|TNEF]]** format to send attachments. With non-Microsoft email clients you will see the infamous **winmail.dat** attachment, which generally remains as a black box that you cannot open.

Here I explain a recipe to filter such mails at **Local Delivery Agent** stage, i. e. the mail is filtered before it arrives into the user mailbox, the MIME part of type **Application/MS-TNEF** is parsed and every file contained herein, is attached again as a standard MIME part.

The original TNEF attachment is retained, so **the size of the email is roughly doubled**.

===== Reference installation =====

I'm running a mail server based on **Debian 10 Buster**, the IMAP, POP3 and LDA services are provided by **Dovecot**. The Local Delivery Agent have the **Sieve** filtering enabled. You can read the configuration details in this article: **[[postfix_spamassassin_clamav_dovecot#sieve_filtering|Sieve filtering with Dovecot]]**.

===== Installing the tnef-filter script =====

First of all we need a mail filter program which does all the magic. It will receive the mail message as standard input and it will produce the //converted// message to the standard output.

You can download the **tnef-filter** script written by **Graham Edgecombe**, from his **[[https://github.com/grahamedgecombe/tnef-filter|GitHub repository]]**. I copied the binary script into **/usr/local/bin/tnef-filter**.

Running the script on my Debian 10 Buster server, requied the following libraries:

<code>
apt-get install libconvert-tnef-perl libfile-mmagic-perl libmime-tools-perl
</code>

===== The Sieve filter =====

In my installation, each user have a file called **$HOME/sieve_before.d/personal.sieve**, this is a file where I put antispam and antivirus filters, that the user is not allowed to customize. Feel free to add the Sieve filter rule in whichever file suits your needs.

<code>
require ["fileinto", "vnd.dovecot.filter", "mime", "foreverypart"];

# Filter with /usr/local/lib/dovecot/sieve-filter/tnef-filter.sh
# if there is an attachment of type Application/MS-TNEF (e.g. winmail.dat).
foreverypart
{
    if header :mime :anychild :contenttype "Content-Type" "application/ms-tnef"
    {
        filter "tnef-filter.sh";
    }
}
</code>

Notice that you need to include the **mime** and **foreverypart** plugins.

I created the shell script **tnef-filter.sh** into the **/usr/local/lib/dovecot/sieve-filter/** directory; it is a simple one-line command:

<code bash>
#!/bin/sh
/usr/local/bin/tnef-filter
</code>

The directory is the one declared to contains Sieve filters. You can set that location into **/etc/dovecot/conf.d/90-sieve-extprograms.conf**:

<file>
plugin {
    sieve_filter_bin_dir = /usr/local/lib/dovecot/sieve-filter
}
</file>