[Savageman]

In the past I had issues using iframes. Not for rendering or security issue (those work great in my memory). But if your email has a link to your website, and your sandbox iframe disallow Javascript, then this "security context" is carried over to the page that was opened from clicking the link inside the iframe, and you website cannot use JS.

[edit] The solution was "allow-popups-to-escape-sandbox", so I see no reason it would not work.