Who this applies to#
- One-click unsubscribe applies to list email headers and provider rules that require the mechanism
What One-click unsubscribe requires#
- Use an HTTPS List-Unsubscribe URI and a List-Unsubscribe-Post header carrying List-Unsubscribe=One-Click, with both covered by a valid DKIM signature
What this does not require#
- The POST must not depend on cookies, HTTP authorization, or prior browser context
Common mistakes#
- Using an arbitrary URL without the one-click header
- Requiring a browser session for the POST
One-click unsubscribe checklist#
- Publish both headers
- Cover them with DKIM
- Test the endpoint without browser state
Commonly confused with#
OnVoard's take#
Treat one-click as a wire-level contract and test the endpoint independently of a recipient browser session.