{"id":8237,"date":"2019-01-11T00:32:00","date_gmt":"2019-01-10T23:32:00","guid":{"rendered":"http:\/\/159.69.82.204\/win\/?p=8237"},"modified":"2024-10-03T00:33:51","modified_gmt":"2024-10-02T22:33:51","slug":"outlook-external-content-is-not-allowed-in-secure-email","status":"publish","type":"post","link":"https:\/\/borncity.com\/win\/2019\/01\/11\/outlook-external-content-is-not-allowed-in-secure-email\/","title":{"rendered":"Outlook: "external content is not allowed in secure email""},"content":{"rendered":"

[German<\/a>]Users of Outlook 2010 to 2016 may face the problem that they suddenly see the message \"External content is not allowed in secure mail\" when they access e-mail. It's not a bug, it's a feature \u2013 a couple of days ago the right piece of the puzzle has fallen into my picture.<\/p>\n

<\/p>\n

There was something a few months ago \u2026<\/h2>\n

\"\"A few days ago I stumbled upon a German post, where a user reported issues with Outlook. He received the warning \"External content is not allowed in secure mails\". Something rang the bell back in my mind. A short search within my German blog brought the article Microsoft Patchday-Nachlese (9. Oktober 2018)<\/a> as a hit. A reader reported this issue after applying October updates. He wrote:<\/p>\n

Since the October updates in Outlook 2016 (in connection with Exchange 2013), the info text \"external content is not allowed in secure email\" is displayed for signed e-mails.<\/p><\/blockquote>\n

At that time I did not find a solution \u2013 and I wasn't aware, that KB4461440 <\/em>has been the root cause for this behavior. Also mention Exchange 2013 turned me to the wrong the direction. I received this comment<\/a> which directs to the right point, but I overlooked this hint.<\/p>\n

The fix has been found \u2026?<\/h2>\n

The day before I stumbled upon a German Dr. Windows article Tipp: Outlook-Meldung \"Externer Inhalt ist in sicheren Mails nicht zul\u00e4ssig\" beheben<\/a>. Martin Geu\u00df, a MVP colleague has also been confronted with that problem. He wrote that DHL delivery notification e-mails contain this error. It could also be, that signed e-mails – and images embedded in websites are then blocked. It is the old problem of mixed content on secure pages.<\/p>\n

\"Outlook<\/a>
\n(Source: Dr. Windows, Click to zoom<\/a>)<\/p>\n

Martin Geu\u00df named the right option for a German Outlook 2016, that is responsible for the warning mentioned above.<\/p>\n

1. Go to Outlook options and select the category Trust Center<\/em>.<\/p>\n

2. Go to the sub category Automatic download <\/em>and uncheck the checkbox with the option Bilder in verschl\u00fcsselten oder signierten HTML-E-Mails nicht herunterladen<\/em> (English might be \"Don't download pictures in encrypted or signed HTML email messages.\").<\/p>\n

This has also been discussed briefly here<\/a> and here<\/a>. This means that the unchecked Outlook security feature is no longer used. The error message is gone and external content is displayed again. At the same time, however, the signed e-mail can be tracked via this downloaded external content. Keywords are tracking pixels. Therefor read the following explanations.<\/p>\n

Introducted via update<\/h2>\n

While writing the German version of this blog post I wanted to know more about it and searched the internet. I came across this German Technet forum post from October 2018. Someone there had described the problem and referred to my blog post mentioned above. Short time later the same solution was published there. There is also the 32-bit DWORD registry value:<\/p>\n

DisallowSMIMEExternalContent<\/em><\/p>\n

within HKCU\\Software\\Microsoft\\Office\\xx\\Outlook\\Security\\ <\/em>(xx is a placeholder for the Office version 14.0, 15.0, 16.0). A value 0 disables the option, and 1 set the option. Within the German Technet post I found the note:<\/p>\n

Important:<\/strong> This option isn't available on unpatched systems.<\/p><\/blockquote>\n

A hint that Microsoft has introduced a new option with an update. There is also a reference to this Microsoft document<\/a> where blocking external content (Web beacons) for Office is described. In the meantime, there are other web sites where the topic has been addressed since November or December 2018.<\/p>\n

Microsoft's Reaction to the Efail vulnerability<\/h2>\n

It was not explicitly mentioned above because I only wrote about digitally signed mails. The mails can also be encrypted. In this case, external content can be used to retrieve such encrypted emails unencrypted. The whole topic runs under the Efail vulnerability<\/a> known since May 2018. If you receive encrypted e-mails, you should not deactivate the above option. Maybe it will help.<\/p>\n","protected":false},"excerpt":{"rendered":"

[German]Users of Outlook 2010 to 2016 may face the problem that they suddenly see the message \"External content is not allowed in secure mail\" when they access e-mail. It's not a bug, it's a feature \u2013 a couple of days … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[463,11],"tags":[47,395],"class_list":["post-8237","post","type-post","status-publish","format-standard","hentry","category-issue","category-office","tag-issue","tag-outlook"],"_links":{"self":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/8237","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/comments?post=8237"}],"version-history":[{"count":1,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/8237\/revisions"}],"predecessor-version":[{"id":35351,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/8237\/revisions\/35351"}],"wp:attachment":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/media?parent=8237"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/categories?post=8237"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/tags?post=8237"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}