Certification of embedded content in e-mail is provided. A sender wishing to have code certified for inclusion in e-mail sends the code to a token authority. A code verification engine acting automatically or in conjunction with an analyst examines the code to determine whether it poses a risk of harm to e-mail recipients. If not, the token authority issues a certificate for the embedded content. The mail sender sends e-mail to recipients including the embedded content, and the certification is sent in conjunction with the content itself. A mailbox provider inspects the received e-mail to determine whether it includes embedded content and, if so, whether a certification is attached that the embedded content is not harmful. If not, or if the message includes uncertified content in addition to certified content, then the message is rejected, or delivered with a warning that certification is not present.