Why do we set use RTF to never in Exchange Online?
Overview
Section titled “Overview”The Opensense configuration requires Rich Text Format (RTF) to be disabled in Exchange Online. The short answer to why: Microsoft recommends it. RTF is a legacy, proprietary email format that Microsoft created before HTML email was popular, and Microsoft has deprecated it in favor of HTML.
Why Opensense requires RTF to be disabled
Section titled “Why Opensense requires RTF to be disabled”
Microsoft recommends HTML over RTF
Section titled “Microsoft recommends HTML over RTF”A common confusion is that Microsoft’s RTF is the same as HTML. They are completely different. Microsoft recommends HTML:
“You can use RTF when you send messages inside an organization that uses Microsoft Exchange, but we recommend that you use the HTML format.”
Change the message format to HTML, Rich Text Format, or plain text
Outlook on the web can’t send RTF
Section titled “Outlook on the web can’t send RTF”Microsoft decided not to support sending email in RTF from Outlook on the web (OWA). OWA can read RTF, but only for legacy support:
OWA can read messages formatted in RTF, but can’t format or send this format.
RTF opens security risks
Section titled “RTF opens security risks”Even if your systems have the latest Microsoft patches, RTF opens potential paths for attack. Opensense expects RTF to be phased out over time.
An in-depth article about exploits related to RTF and OLE:
Microsoft Rich Text Format is heavily used in the email attachments in phishing attacks. It has been gaining massive popularity and its wide adoption in phishing attacks is primarily attributed to the fact that it has an ability to contain a wide variety of exploits and can be used efficiently as a delivery mechanism to target victims.
An Inside Look into Microsoft Rich Text Format and OLE Exploits
An example security alert related to RTF in Outlook: Microsoft Outlook retrieves remote OLE content without prompting.
Recognizing RTF email: winmail.dat attachments
Section titled “Recognizing RTF email: winmail.dat attachments”A winmail.dat attachment on an email is one sign that the message is in RTF. Exchange decides when to apply RTF with these TNEF conversion options for messages to external recipients, from highest to lowest priority:
- Remote domain settings
- Mail user or mail contact settings
- Outlook settings
Background: TNEF and RTF
Section titled “Background: TNEF and RTF”
TNEF and RTF are related, but they are not exactly the same. It can get confusing, because the two terms are used interchangeably.
Microsoft’s technical references:
- Content conversion in Exchange Server: how content conversion happens in Exchange.
- [MS-OXTNEF]: Transport Neutral Encapsulation Format (TNEF) Data Algorithm
- 2.2.3.2 Extracting Encapsulated HTML from RTF
- [MS-OXCMSG]: Message and Attachment Object Protocol
What’s next
Section titled “What’s next”- Microsoft 365 integration overview (change request): where disabling RTF fits in the Microsoft 365 setup.
- How does Opensense work with Microsoft 365?: how Opensense applies signatures in Microsoft 365.