MSG vs EML: Two Ways to Save an Email

Saving an email as a file gives you either a .msg or an .eml, depending on the program. They both hold one message, but they are built very differently, and the difference decides which programs can open them and what survives the save.

EML: the internet standard

An .eml file is a text file in the format the internet uses to carry mail: RFC 5322 headers followed by a body, structured with MIME when there are several parts. It starts with lines like From:, To:, Subject: and Date:, a Received: line for each server the message passed, and then the content, which may contain a plain-text part, an HTML part, inline images and attachments, each encoded as text (often Base64). Most mail programs (Thunderbird, Apple Mail, many web mail systems) read and write it, and you can open it in a text editor to look at the headers.

MSG: Outlook's format

A .msg file is Microsoft's format, a binary compound file (the MS-OXMSG structure on top of the Compound File Binary format), a small file system holding the message's properties as streams: subject, sender, recipients, body, attachments, and many Outlook-specific fields. It keeps things Outlook knows about, such as the exact stored recipient list and sometimes only a formatted copy of the body. The transport headers (the ones with the Received trail) are included when the message came from the internet, but they are stored as one property rather than the structure of the file. Programs other than Outlook open .msg files only with special support.

What each keeps

• Headers. EML keeps them exactly as transmitted. MSG keeps the transport headers as a property for received mail; a message that was never sent may have none.
• Body. EML has plain text and HTML as they were. MSG may hold plain text, HTML, or only a compressed RTF version; when HTML is stored inside RTF, it can be reconstructed from the encapsulated tags.
• Attachments. Both keep them; in MSG an attachment can itself be a message.
• Addresses. MSG may store an Exchange-internal address instead of the internet address for people inside the organisation.

Opening them safely

The MSG & EML Email Viewer opens both in your browser and shows headers, recipients, the body in HTML or plain-text view and the attachments, without uploading the message. Because HTML mail can contain scripts, trackers and misleading links, the viewer removes active content, blocks remote images and styles, and shows the result in a sandboxed frame; attachments are listed and saved as plain files, never opened.

Things to look at in a suspicious message

• A Reply-To address on a different domain than the sender.
• A display name that does not match the address.
• Links whose visible text differs from where they lead; the viewer lists the link targets.
• Attachments with executable, script, macro or HTML extensions, or double extensions such as invoice.pdf.exe.
• The Authentication-Results header: it is text written by the receiving server and shows whether SPF, DKIM and DMARC checks passed there; it is not something a saved file can prove by itself.

When you need a copy of a message for a file, saving it as PDF gives you something anyone can open, and keeping the original .eml or .msg keeps the evidence. If an attachment is a PDF you do not trust, the PDF Active Content Scanner can inspect it without running it, and the PDF Attachments Extractor shows what is embedded.