Anything other than basic text formatting is at least a major security problem. The simplest scenario is a phishing attack that disguises itself as a plaintext

Anything other than basic text formatting is at least a major security problem. The simplest scenario is a phishing attack that disguises itself as a plaintext message, with blue underlined URLs that are actually links to the attacker's site. There have also be CSRF attacks carried out by HTML mail. More sophisticated attacks are also possible: http://blog.mxlab.eu/2010/03/13/phishing-emails-with-attached-html-forms-instead-of-embedded-urls/ http://blog.mxlab.eu/2010/03/13/phishing-emails-with-attache... Even more sophisticated attacks could be imagined. Suppose you train users to look for a digital signature check; an HTML message could be used to create something that looks like such a check, tricking people into believing they received a signed message. The sort of monitoring used to unsubscribe Fab's readers could have been used to determine when people are at their desks in a particular office, or who is more likely to read a scam message. It is a no-brainer: HTML mail allows the sender of a message to render things of their choosing on your screen, and potentially execute code they have written on your computer (similar things can be said about the web; the difference is that setting up a website is useless if nobody visits it, but with email you get to send someone the message without waiting for them to request it). There are other complaints about HTML mail, but the security angle is biggest in my opinion.