Email security, from sender to you mailbox
SMTP is by design unsafe cause it's doesn't authenticate sender. So an attackant clever enough can forge a "safe looking" email just using telnet.
There's some initiatives to make SMTP safer: SPF and others, authenticated SMTP servers, PGP, etc... but since none of them has widely spread, smtp stay untrustable.
Also, keep in mind that even if it's email source show the same couple of relays has usual, the same mailer, etc..., this still won't make email safe cause attacker could control your correspondent mailbox because of:
a leak on a public site where your correspondent used same email
address and same password than email account to register into.
A bruteforce attack, a vulnerability in FAI webmail software, a malware on his computer.
someone hijacking his session (always lock your computer if you go downstairs to smoke a cigarette).
A man pointing a gun in front of him and telling him to write that email.
The answer is clearly NO :) (and yeah, actually, every kind of communication is unsafe)
Email security, in your mailbox (added because of question edit)
Since the original question has evolved, let's continue answering ;-)
As you say, an email can embed malicious code to exploit a vulnerability into your MUA. We can classify vulnerabilities into two categories:
- Vulnerabilities in HTML renderer
- Vulnerabilities in email's envelope (basically, headers parsing etc...).
I wish than, today, most of MUA embed improved and robust code for email's envelope parsing.
Since envelope hasn't change for decades and it's quite basic (<header name>: <header value>) we can hope than this part is safe.
But only "hope"... keep in mind that regression are introduced every day on every kind of software (Take a look at CVE-2007-6165 and CVE-2006-0395 for example).
And also remember that all vulnerabilities are not published, so unknown exploit can be used to abuse your email client.
To finish, the worst and more dangerous part is the HTML rendering engine: since it's in constant evolution, code evolve too and an attacker could try to exploit some vulnerabilities in this specific piece of software.
HTML email is, IMHO, the most dangerous part of email.
Inspecting .eml will help you discover the more obvious attempts to exploit any vulnerabilities: malformed headers, strangely named attachments (big_b00bs.jpg.exe)
But since attack vector can be many others things, i think that this still isn't enought to consider an email safe.
- you disable HTML rendering.
- you disable image displaying.
- you're cautious with attachment.
- you use a antivirus (server-side is prefered) on your email chain.
- you use a sandboxed email client.
You're like 90% safe :)