Do iframes work in emails? Short answer: no
You can put an iframe in an email. It will not survive the trip. Here is why every major provider strips them, and what to do instead when you need dynamic content in a message.
More web and WordPress tutorials
There is no video for this one, but I cover web development, WordPress and the tools around them on the channel. Subscribe to catch new tutorials the moment they go live.
The short version
Technically you can drop an <iframe> into an HTML email exactly as you would on a web page. In practice it will not render. Every major provider either strips the tag outright or flags the whole message as spam, because iframes were abused for phishing and drive-by code for decades. Plan as though no recipient will ever see it, and use a linked image pointing at a landing page instead.
Link out to a page, do not embed oneThe question that started it
While standardising the email signatures for my day job I was asked something genuinely interesting: could we use an iframe to pull a custom layout from a website straight into the signature? One source of truth, updated centrally, appearing in everyone's outgoing mail. It is a lovely idea.
I had a feeling I knew the answer, but I wanted to explore the options properly rather than dismiss it out of hand. So here is the full version, including what to do instead.
Can you put an iframe in an email?
Yes. You can insert the markup without any problem, exactly as you would when working on a website. Most email builders will not even complain, and if you preview the HTML in a browser it will look perfect, which is precisely the trap. A browser is not an email client.
Should you put an iframe in an email?
No, you should not. The unfortunate truth is that a few bad apples ruined it for everyone else. Scammers and attackers used embedded iframes in email to phish credentials and to load malicious code onto a victim's machine automatically, and they have been doing it since not long after the tag existed in the late nineties.
Because of those bad actors, almost every email provider will either sanitize the iframe, meaning it simply never runs, or take a dimmer view still and flag the entire message as spam. Either way your recipients will not see what you built, and in the worse case they will not see the email at all.
There is no graceful fallback. Unlike most email quirks, you cannot detect the failure and show something else instead. When a client strips the tag, it strips the content inside it too, so the recipient gets a blank space where your layout should be. That alone rules it out for anything that matters.
Which email clients support iframes?
Effectively none of the ones your recipients actually use. Below are the providers whose behaviour I can state plainly, followed by the rule that covers everything else.
| Client | Renders an iframe? | What actually happens |
|---|---|---|
| Gmail | No | Strips the tag during sanitization. Content inside it never reaches the reader. |
| Outlook | No | Not supported in either the desktop or web clients. |
| Yahoo Mail | No | Blocks embedded iframe content as a matter of policy. |
| Everything else | Assume no | Support across the remaining clients is negligible and inconsistent. The only safe planning assumption is that it will not render, and may cost you the inbox. |
Even in the rare case where something does render, you have won very little: the message is now far more likely to be filtered as spam, which is a worse outcome than the layout simply not appearing.
What to do instead
Every practical alternative shares one idea: stop trying to run the page inside the message, and send people to the page instead.
- Use a linked image. Export the layout as an image, drop it into the email, and link the whole thing to the real page. This is the closest you get to the original goal, and it works everywhere.
- Copy the content into the email itself. If it is a form or a landing page, rebuild the important part in normal email-safe HTML, using tables and inline styles, and link out for the rest.
- Link out plainly. For a signature, a simple text or image link to the canonical page is more reliable than anything clever, and it will still be working in five years.
For the signature problem that prompted all this, the honest answer is that the centrally-updated dream does not survive contact with email clients. What does work is a hosted image referenced by URL, since you can replace the image file centrally and every signature picks up the new version. Just be aware that many clients block remote images by default until the reader allows them, so never put anything essential, like your phone number, inside the image alone.
Frequently Asked Questions
Do iframes work in emails?
No. You can insert the markup, but every major email provider either strips the iframe during sanitization or flags the message as spam, so recipients will not see the embedded content.
Why do email clients block iframes?
Because they were abused. Attackers used embedded iframes to phish information and to load malicious code onto a recipient's computer automatically, so clients now sanitize them out as a security measure.
Does Gmail support iframes in emails?
No. Gmail strips iframe tags during sanitization, and the content inside the iframe never reaches the reader. Outlook and Yahoo Mail block them as well.
Can you show a fallback when an iframe is blocked?
No. When a client strips the tag it removes the content inside it too, so there is no reliable way to detect the failure and display something else. The reader simply sees a blank space.
What should you use instead of an iframe in an email?
Use an image linked to the real page, or rebuild the important content in email-safe HTML and link out for the rest. A hosted image referenced by URL can be updated centrally, which covers most of what people want iframes for.
Not worth the trip
With a large and growing list of providers either blocking iframes outright or treating them as a spam signal, there is really no reason to go down this path. The technique fails silently, it fails everywhere that matters, and it can take the whole message down with it.
Send a link. It is less exciting, and it will still work long after any clever embedding trick has stopped.
Disclosure: This post contains affiliate links. As an Amazon Associate I earn from qualifying purchases, at no extra cost to you. Affiliate links like these and my YouTube channel are what keep the site running.