It will block everything except for text unless you say otherwise.Outlook (from Office) and Outlook Express had a bad reputation when it came to security FOR YEARS. Their default behaviour was to run anything in the email itself (javascript, active-x controls, etc) once it was opened for viewing.