One-Click Unsubscribe

One-click unsubscribe is a standard, defined in RFC 8058, that lets a recipient opt out with a single action in their mail client, which sends an HTTPS POST to the sender. Gmail and Yahoo have required it for bulk marketing mail since 2024.

Deliverability & Email InfrastructureUpdated September 30, 2026

In short

One-click unsubscribe lets people opt out instantly from the inbox, with no web page or login.

Key points

  1. RFC 8058 works by pairing a List-Unsubscribe Header containing an HTTPS URL with a List-Unsubscribe-Post: List-Unsubscribe=One-Click header [1].
  2. The mail client sends a POST request to the URL; the sender must not require a login, confirmation page or cookies to complete the opt-out [1].
  3. Gmail requires one-click unsubscribe for marketing and subscribed messages from senders of about 5,000 or more messages a day to personal Gmail accounts [2].
  4. Gmail recommends fulfilling requests within 48 hours, and Yahoo asks for removal within 2 days [2][3].
  5. Legal opt-out rules still apply on top: the CAN-SPAM Act allows no more than 10 business days to honor a request [4].

How the mechanism works

Before RFC 8058, the List-Unsubscribe header could point to a web page, but a mail client following that link could not know whether a single request was enough, and security scanners that prefetch links could trigger opt-outs by accident. RFC 8058, published in 2017, solves this by using POST instead of GET [1]. The sender includes an HTTPS URI in List-Unsubscribe and adds List-Unsubscribe-Post with the value List-Unsubscribe=One-Click. When the user clicks the client's unsubscribe control, the client posts that value to the URI and the sender removes the address. The RFC requires the message to carry a valid DKIM (DomainKeys Identified Mail) signature covering both headers, so the instruction cannot be forged or altered in transit [1].

Gmail and Yahoo requirements

One-click unsubscribe became a mainstream requirement with the Gmail and Yahoo sender rules that took effect in February 2024. Gmail requires bulk senders to support it in marketing and subscribed messages and also to include a visible unsubscribe link in the message body [2]. Its FAQ explains that transactional messages such as password resets are exempt [2]. Yahoo's Sender Hub lists one-click list-unsubscribe as a bulk sender requirement and asks for unsubscribes to be honored within 2 days [3]. Offering an easy exit also has a practical payoff: people who can leave in one click are less likely to press the spam button, which keeps the Spam Complaint Rate down and protects Domain Reputation.

Building it into a sending setup

Implementation needs three parts: header generation, a POST endpoint and a Suppression List. Each message should carry a unique token in the URL so the endpoint knows which recipient and list to remove without asking. The endpoint should respond quickly, record the request and ensure no further campaign or Email Sequence step reaches that person. Test that the headers survive your sending path and are included in the DKIM signature, since some relays add or rewrite headers. For one-to-one Cold Email from a regular mailbox, many teams rely on a short Opt-Out line and honor reply requests instead. That is a different mechanism, but the obligation to stop is the same under the CAN-SPAM Act and GDPR [4].

Sources
  1. RFC 8058: Signaling One-Click Functionality for List Email Headers — RFC Editor
  2. Email sender guidelines FAQ — Gmail Help
  3. Sender Best Practices — Yahoo Sender Hub
  4. CAN-SPAM Act: A Compliance Guide for Business — Federal Trade Commission
External sources open in a new tab.

Related terms

Mentioned in

Outreach without the busywork.

PineLead finds new B2B prospects every day, qualifies them against your criteria and writes the first email in your voice. You approve — PineLead sends.

Start free with 100 credits →