---
title: "Why do we set use RTF to never in Exchange Online?"
slug: "why-do-we-set-use-rtf-to-never-in-exchange-online"
description: "Opensense requires Rich Text Format (RTF) to be off in Exchange Online, because Microsoft recommends HTML, OWA cannot send RTF, and RTF carries security risks."
updated: 2025-04-29T15:58:53.000Z
canonical: "https://help.opensense.com/docs/why-do-we-set-use-rtf-to-never-in-exchange-online"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.opensense.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Why do we set use RTF to never in Exchange Online?

## Overview

The Opensense configuration requires Rich Text Format (RTF) to be disabled in Exchange Online. The short answer to why: Microsoft recommends it. RTF is a legacy, proprietary email format that Microsoft created before HTML email was popular, and Microsoft has deprecated it in favor of HTML.

## Why Opensense requires RTF to be disabled


### Microsoft recommends HTML over RTF

A common confusion is that Microsoft's RTF is the same as HTML. They are completely different. Microsoft recommends HTML:

> "You can use RTF when you send messages inside an organization that uses Microsoft Exchange, but we recommend that you use the HTML format."
>
> [Change the message format to HTML, Rich Text Format, or plain text](https://support.office.com/en-us/article/change-the-message-format-to-html-rich-text-format-or-plain-text-338a389d-11da-47fe-b693-cf41f792fefa)


### Outlook on the web can't send RTF

Microsoft decided not to support sending email in RTF from Outlook on the web (OWA). OWA can read RTF, but only for legacy support:

> OWA can read messages formatted in RTF, but can't format or send this format.
>
> [Message format and transmission in Exchange Online](https://docs.microsoft.com/en-us/exchange/mail-flow-best-practices/message-format-and-transmission)


### RTF opens security risks

Even if your systems have the latest Microsoft patches, RTF opens potential paths for attack. Opensense expects RTF to be phased out over time.

An in-depth article about exploits related to RTF and OLE:

> Microsoft Rich Text Format is heavily used in the email attachments in phishing attacks. It has been gaining massive popularity and its wide adoption in phishing attacks is primarily attributed to the fact that it has an ability to contain a wide variety of exploits and can be used efficiently as a delivery mechanism to target victims.
>
> [An Inside Look into Microsoft Rich Text Format and OLE Exploits](https://www.mcafee.com/blogs/other-blogs/mcafee-labs/an-inside-look-into-microsoft-rich-text-format-and-ole-exploits/)

An example security alert related to RTF in Outlook: [Microsoft Outlook retrieves remote OLE content without prompting](https://www.kb.cert.org/vuls/id/974272).


## Recognizing RTF email: winmail.dat attachments

A `winmail.dat` attachment on an email is one sign that the message is in RTF. Exchange decides when to apply RTF with these TNEF conversion options for messages to external recipients, from highest to lowest priority:

> 1. Remote domain settings
> 2. Mail user or mail contact settings
> 3. Outlook settings
>
> [Exchange Server: TNEF conversion options](https://docs.microsoft.com/en-us/exchange/mail-flow/content-conversion/tnef-conversion?view=exchserver-2019)

## Background: TNEF and RTF


TNEF and RTF are related, but they are not exactly the same. It can get confusing, because the two terms are used interchangeably.


Microsoft's technical references:

- [Content conversion in Exchange Server](https://docs.microsoft.com/en-us/exchange/mail-flow/content-conversion/content-conversion?view=exchserver-2019): how content conversion happens in Exchange.
- [\[MS-OXTNEF\]: Transport Neutral Encapsulation Format (TNEF) Data Algorithm](https://docs.microsoft.com/en-us/openspecs/exchange_server_protocols/ms-oxtnef/1f0544d7-30b7-4194-b58f-adc82f3763bb)
- [2.2.3.2 Extracting Encapsulated HTML from RTF](https://docs.microsoft.com/en-us/openspecs/exchange_server_protocols/ms-oxrtfex/906fbb0f-2467-490e-8c3e-bdc31c5e9d35)
- [\[MS-OXCMSG\]: Message and Attachment Object Protocol](https://docs.microsoft.com/en-us/openspecs/exchange_server_protocols/ms-oxcmsg/7fd7ec40-deec-4c06-9493-1bc06b349682)

## What's next

- [Microsoft 365 integration overview (change request)](https://help.opensense.com/docs/change-request-office-365-integration-with-opensense): where disabling RTF fits in the Microsoft 365 setup.
- [How does Opensense work with Microsoft 365?](https://help.opensense.com/docs/how-does-opensense-work-with-office-365): how Opensense applies signatures in Microsoft 365.