Email authentication and deliverability
One-click unsubscribe (RFC 8058)
A standard way for mail apps to unsubscribe a reader with one POST request, required by Gmail and Yahoo for bulk senders since 2024.
The email carries two headers: List-Unsubscribe with an https URL and List-Unsubscribe-Post: List-Unsubscribe=One-Click. When the reader clicks Unsubscribe in the mail app, the provider sends a POST with the body List-Unsubscribe=One-Click to that URL, without cookies or login, and the sender must stop mailing that address. Both headers must be covered by a valid DKIM signature, and a plain GET on the URL must not unsubscribe, because link scanners open links.
Related terms
- List-Unsubscribe header: An email header (RFC 2369) with a mailto or web address that mail apps use to show their own Unsubscribe button.
- DKIM (DomainKeys Identified Mail): A signature on each message, checked against a public key in your DNS.
- DMARC: The policy that tells receivers what to do when mail fails SPF and DKIM, and where to report.
