So normally when Exchange sends out a TNEF message, the message structure is something like this:
...
Content-Type: multipart/mixed;
boundary="_000_AM0PR09MB277052D243401DC2ED6D32A4B27C0AM0PR09MB2770eurp_"
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
<AM0PR09MB277052D243401DC2ED6D32A4B27C0@AM0PR09MB2770.outlook.com>
--_000_AM0PR09MB277052D243401DC2ED6D32A4B27C0AM0PR09MB2770eurp_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
--_000_AM0PR09MB277052D243401DC2ED6D32A4B27C0AM0PR09MB2770eurp_
Content-Disposition: attachment; filename="winmail.dat"
Content-Transfer-Encoding: base64
Content-Type: application/ms-tnef; name="winmail.dat"
--_000_AM0PR09MB277052D243401DC2ED6D32A4B27C0AM0PR09MB2770eurp_--
A multipart mixed message with two mime parts: the plain text first, the TNEF part second. Rich text formatting and attachment are in the TNEF part. That's how we just to hate it.
Problem
Now I started seeing from two different domains a new MIME structure:
...
Content-Type: multipart/mixed;
boundary="_000_AM0PR06MB5394D1F1B085F52243304062FD4D0AM0PR06MB5394eurp_"
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
<AM0PR06MB5394D1F1B085F52243304062FD4D0@AM0PR06MB5394.outlook.com>
--_000_AM0PR06MB5394D1F1B085F52243304062FD4D0AM0PR06MB5394eurp_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
[cid:image001.jpg@01D4D590.C0A2AB00]
--_000_AM0PR06MB5394D1F1B085F52243304062FD4D0AM0PR06MB5394eurp_
Content-Disposition: attachment; filename="winmail.dat"
Content-Transfer-Encoding: base64
Content-Type: application/ms-tnef; name="winmail.dat"
--_000_AM0PR06MB5394D1F1B085F52243304062FD4D0AM0PR06MB5394eurp_
Content-Type: application/pdf
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="Some.pdf"
--_000_AM0PR06MB5394D1F1B085F52243304062FD4D0AM0PR06MB5394eurp_
Content-Type: image/jpeg
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="image001.jpg"
--_000_AM0PR06MB5394D1F1B085F52243304062FD4D0AM0PR06MB5394eurp_--
Here the TNEF part seems to only include the rich formatting and the attachments are part of the mixed multipart. Unfortunately with this mime generation, the Content-ID is not preserved, so the cid reference in the text part and in the HTML encode in TNEF part can't be resolved.
Question
My question is NOT how to disable TNEF in general. My question is what configuration triggers this short of MIME generation.
Some more headers that might give a clue:
x-originating-ip: ...
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: ...
x-microsoft-antispam: ...
x-ms-traffictypediagnostic: ...
x-ms-exchange-purlcount: 1
x-microsoft-exchange-diagnostics: ...
x-microsoft-antispam-prvs: ...
x-forefront-prvs: 0970508454
x-forefront-antispam-report: ...
received-spf: ...
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam-message-info: ...
MIME-Version: 1.0
X-OriginatorOrg: kairos.be
X-MS-Exchange-CrossTenant-Network-Message-Id: 2530d08a-1094-4f6f-fa0d-08d6a39f8227
X-MS-Exchange-CrossTenant-originalarrivaltime: 08 Mar 2019 08:24:39.6698
(UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: ...
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-Transport-CrossTenantHeadersStamped: ...
