Google requires it of bulk senders. So does Yahoo. Everyone calls it “one-click unsubscribe”, and almost everyone believes it means a link to put in the message.
It is a protocol. It fits in a nine-page specification, published in January 2017 as RFC 8058, and it imposes things your sending platform may well not do.
Two headers, not a button
The ancestor dates from 1998: RFC 2369 introduced the List-Unsubscribe header, letting a mail client know the unsubscribe address without the user having to hunt through the message body.
RFC 8058 adds a second header, List-Unsubscribe-Post, and above all a precise mechanism. The “Unsubscribe” button Gmail displays next to the sender name is not a link clicked by the user: it is a request issued by the mailbox provider, on your behalf.
What the specification requires, word for word
An HTTPS address, mandatory. “The List-Unsubscribe header field MUST contain one HTTPS URI.” No plain HTTP. A mailto alone does not satisfy the requirement, and Google restates this explicitly in its guidelines.
A POST request, with a prescribed body. The provider sends a POST to that address, passing the pair List-Unsubscribe=One-Click as the request body. The format should preferably be multipart/form-data, or application/x-www-form-urlencoded.
No context transmitted. “The POST MUST NOT include cookies, HTTP authorization, or any other context information.” Your endpoint therefore receives an anonymous request: all recipient identification must fit inside the address itself, in a form that cannot be guessed.
No redirect. “The mail sender MUST NOT return an HTTPS redirect.” Redirecting to a confirmation page is a breach of the specification.
A DKIM signature covering both headers. This is the least known requirement, and the most decisive: “Senders MUST apply at least one valid DKIM signature to the message. The List-Unsubscribe and List-Unsubscribe-Post headers MUST be covered by the signature.” And if that signature is missing, the mailbox provider “SHOULD NOT offer a one-click unsubscribe for that message”.
Operational translation: without a correctly configured DKIM signature that includes those two headers in its h= field, your button does not appear. You have met the letter of Google’s requirement, and you are non-compliant.
What the specification does not say, and is made to say
RFC 8058 does not formally forbid showing a confirmation page to a human following the link in a browser. What it requires is that the POST alone be enough to perform the unsubscribe, with no software having to interpret the content of a page.
The consequence is simple: your endpoint must process the unsubscribe on receiving the POST. Immediately. Not on the next click, not after a preferences form is submitted, not after confirmation by email.
A preferences centre remains possible for the person arriving via the link in the message body. It cannot be the only way out.
The deadline, and why it matters more than the mechanism
Google asks that unsubscribe requests be honoured within 48 hours. Yahoo says two days, and specifies that beyond that the sender is no longer considered compliant.
Two days for an operation that should take two seconds is a generous tolerance, granted to systems that synchronise lists in batches. It does not excuse the cases where the next message goes out the following morning.
And there is a very concrete reason to do better than the tolerance: a recipient who unsubscribes and still receives a message does not unsubscribe a second time. They click “Report spam”. You have just traded a clean exit for a complaint, and the complaint is the only number that decides your deliverability.
Unsubscribing is also a legal obligation, elsewhere and differently
These requirements are technical and private: they come from mailbox providers, not from a legislature.
The law says something else, and in some cases less. In the United States, the CAN-SPAM Act allows ten business days to process a request. In France, the right to object to marketing is absolute and requires no stated reason, and the ability to object must be offered with every send.
So you do not have one deadline, you have several, and the shortest one governs you. In practice the shortest is almost always the mailbox providers’, because it is the one with an immediate penalty.
What to do tomorrow morning
Send yourself a real campaign and open the full headers of the message received. Look for List-Unsubscribe and List-Unsubscribe-Post, then find the h= field of the DKIM signature and check that both names appear in it.
Then test your endpoint by issuing the POST yourself, with the exact body the specification prescribes, with no cookie and no authorisation header. If the unsubscribe is not recorded from that single request, your button is decorative.
Finally, measure the real delay between an unsubscribe and the last message sent to that address. At most senders that delay is not measured, and it is precisely where complaints are manufactured. When the exit is handled by the sending mechanism itself, as Sestaro’s encrypted unsubscribe link does, that delay is zero by construction.
Sources
- Levine, J. & Herkula, T. (January 2017). Signaling One-Click Functionality for List Email Headers, RFC 8058, Proposed Standard
- Neufeld, G. & Baer, J. (July 1998). The Use of URLs as Meta-Syntax for Core Mail List Commands and their Transport through Message Header Fields, RFC 2369, Proposed Standard
- Google Workspace Admin Help. Email sender guidelines FAQ
- Yahoo Sender Hub. Best Practices
- Federal Trade Commission. CAN-SPAM Act: A Compliance Guide for Business
- CNIL (updated 10 June 2026). La prospection commerciale par courrier électronique, SMS-MMS et automate d’appel
LaFactory works email on the evidence: headers, DNS records, rejection logs. No open rate promises, ever. Get in touch for a deliverability audit.