Definition
One-click unsubscribe uses List-Unsubscribe and List-Unsubscribe-Post headers as specified by RFC 8058. Supporting mailboxes can present a native unsubscribe control and send a POST request to the HTTPS URL.
It complements rather than replaces the clearly visible unsubscribe link in the message body. Google requires both for marketing and subscribed messages from senders above its bulk threshold.
Why it matters
A simple exit gives recipients an alternative to the spam button and helps senders honor preference changes quickly. It also keeps unsubscribe behavior available when message HTML does not render as expected.
How it works
- 01
The sender adds an HTTPS unsubscribe URL in List-Unsubscribe.
- 02
List-Unsubscribe-Post declares the one-click operation.
- 03
The relevant headers are covered by a valid DKIM signature.
- 04
The mailbox provider can POST the request and the sender suppresses future covered mail promptly.
Example
List-Unsubscribe: <https://email.example/unsubscribe/opaque-token>
List-Unsubscribe-Post: List-Unsubscribe=One-Click
The URL must identify the subscription safely without requiring a login.Common mistakes
- Using a GET request that unsubscribes when security scanners follow the link.
- Requiring login, password, or another confirmation after the one-click POST.
- Omitting the visible body unsubscribe link.
- Failing to DKIM-sign the list headers.
Key takeaways
- One-click is a header-based POST flow.
- Keep a visible unsubscribe link in the body.
- Use opaque, scoped tokens and honor requests promptly.