One-Click Unsubscribe

RFC 8058 solves a real problem. The original List-Unsubscribe header carried a URL, but security software and mail clients sometimes fetch URLs in headers automatically, which could trigger accidental unsubscribes. One-click fixes this by requiring a deliberate, unambiguous action: the client sends an HTTPS POST request (not a GET that a scanner might trip) only when the user actually clicks unsubscribe.

To advertise that the link is safe for one-click, the sender adds a second header, List-Unsubscribe-Post, containing exactly List-Unsubscribe=One-Click. When the client sees both headers, it shows the native unsubscribe control; on a click, it POSTs to the HTTPS URL with that same key-value pair in the body, and your server suppresses the address. No second click, no form, no landing page is shown to the recipient.

One-click is not a single header; it is the pairing of List-Unsubscribe (which carries the HTTPS URL) with List-Unsubscribe-Post (which marks that URL as one-click capable). The URL must be HTTPS, and the message must carry a valid DKIM signature that covers both headers.

RFC 8058 is strict about a few details, and getting any of them wrong means the click does nothing:

• POST, not GET. The client sends an HTTP POST so passive URL-fetching never fires the unsubscribe by accident.
• No redirects. The endpoint must not return an HTTPS redirect, because many browsers turn a redirected POST into a GET and lose the body.
• Must be DKIM-signed. The message needs a valid DKIM signature covering the List-Unsubscribe headers, or receivers will not trust the one-click action.
• HTTPS only. The one-click URL has to be HTTPS; a plain HTTP URL does not qualify.

And the obligation does not end at the POST: Gmail and Yahoo expect the request to be honored within two days. Wiring up the headers but failing to actually suppress the address defeats the entire mechanism and invites spam complaints.