RPMSG file: why it won’t open, and how to read the message

What an .rpmsg file is

When someone protects an email in Outlook, for example with Do Not Forward, Encrypt or a sensitivity label such as Confidential, Microsoft’s rights management encrypts the message text and its attachments into a single attachment: message.rpmsg. The service behind it is Microsoft Purview Information Protection (formerly Azure Information Protection) in Microsoft 365, or Active Directory Rights Management Services on a company’s own servers.

The email you see is only a wrapper. Its subject, sender and recipients stay readable, and its body usually just says that the message is protected. Inside the .rpmsg file there is a publishing license: who protected the message, with which rights server and template, in plain text; and the list of people allowed to read it, with the key to the content, encrypted so that only the rights server can read them.

Why you got message.rpmsg instead of the email

• Your mail app does not support Microsoft’s protection. Gmail, Apple Mail, Thunderbird and many phone mail apps show the wrapper with an attachment called message.rpmsg, sometimes with a version in the name, such as message_v2.rpmsg.
• You are signed in with an account other than the one the message was sent to, or your address is not among those the sender allowed.
• The email was forwarded, or saved by a backup or archiving tool: the copy keeps the protection, and outside Outlook it shows up as message.rpmsg.
• Conversation view, in any Outlook, does not show protected messages: double-click the message to open it in its own window.

Why no converter can open it

The content is encrypted with a key that only the sender’s rights server hands out, to the people the sender allowed, after they sign in. A website or program that offers to convert an .rpmsg file to PDF or text without that sign-in cannot read the content; at most it shows the same wrapper details this page shows.

Think twice before uploading protected mail anywhere: it was protected because the sender did not want it to travel further. This page reads the file in your browser and sends nothing.

What this page shows

• It recognizes message.rpmsg (also with a version in its name), and Outlook .msg or .eml emails that carry one.
• It shows the subject, sender, recipients and date of the email around it, which are not encrypted.
• It reads the plain-text parts of the publishing license: the rights template’s name and description, the organization’s rights server and where keys are requested, the owner, and when the protection was applied and until when, when the file states them.
• It shows the size of the encrypted content.
• It sends emails that are not protected to our MSG viewer or EML viewer, which open them fully.

What it does not do

• It does not decrypt the message, and does not try to: no rights server is contacted, and nothing about the file is sent anywhere.
• It does not show who may read the message: that list is encrypted for the rights server.
• It does not remove or change the protection.

How to open a protected message

Outlook opens it for the people the sender allowed. In practice:

• Open the email, not the attachment. Outlook decrypts the whole email; a message.rpmsg saved on its own often does not open, even in Outlook.
• Use the right account. Sign in with the address the message was sent to: Outlook on the web (outlook.office.com for work and school accounts, outlook.com for personal ones), classic Outlook for Windows, Outlook for Mac, or the Outlook app for iPhone and Android.
• Open it in its own window. The conversation view may not show protected messages; double-click the message instead.
• If the new Outlook for Windows shows only the attachment, open the same mailbox in Outlook on the web.
• Not using Microsoft 365? Messages encrypted with Microsoft Purview Message Encryption carry a link to Microsoft’s web viewer, where you sign in with Google, Yahoo or Microsoft, or ask for a one-time passcode by email.
• Ask the sender. If none of this works, ask them to send it again without protection, or to allow your address. Only they, or their IT department, can change who may open it.

Your file stays on your device

Protected mail is often confidential. Here the file is read by code running in your browser; no code on the page sends the file or its name anywhere, not even to our own domain, and no rights server is contacted.

Microsoft, Outlook and Microsoft Purview are trademarks of Microsoft Corporation. CantOpen is not affiliated with Microsoft.