What the standard requires
RFC 8058 defines one-click unsubscribe with two headers. The List-Unsubscribe header must contain one HTTPS URI (it may also contain a mailto), and the List-Unsubscribe-Post header must contain exactly List-Unsubscribe=One-Click. [1]
When the reader clicks unsubscribe in their mail app, the mailbox provider sends an HTTPS POST to that URI. The request must not include cookies or HTTP authorization, the sender's endpoint must not return a redirect, and the receiver must not POST without the user's consent. [1] Both headers must be covered by a valid DKIM signature; without it, the receiver should not offer one-click. [1]
Who has to comply and how fast
Mailbox provider rules decide whether you are affected. The thresholds and timelines differ slightly.
| Provider | Who it applies to | Method | Processing time |
|---|---|---|---|
| Gmail | Senders of close to 5,000 or more messages in 24 hours to personal Gmail accounts; Workspace recipients are not counted [3] | List-Unsubscribe-Post plus HTTPS List-Unsubscribe; marketing and subscribed messages only [2] [3] | Recommends fulfilling within 48 hours [3] |
| Yahoo | Bulk senders, for marketing and subscribed messages [4] | POST (RFC 8058) highly recommended; mailto acceptable [4] | Honor within 2 days [4] |
How to check the header in a message you receive
Do not rely on a vendor feature list. Subscribe a personal Gmail address to your own list, send a normal campaign, and inspect it. In Gmail on a computer, open the message, click More next to Reply, and choose Show original; the full header opens in a new window. [5]
- Search for List-Unsubscribe: and confirm it contains an https:// URL.
- Search for List-Unsubscribe-Post: and confirm the value is List-Unsubscribe=One-Click.
- Find the DKIM-Signature header and confirm list-unsubscribe and list-unsubscribe-post appear in its h= list.
- Check that dkim=pass appears in Authentication-Results for your domain.
- Repeat for automation emails (welcome series) as well as broadcasts; they can use different templates.
- If anything is missing, ask the platform's support before your volume grows; this is not usually something you can add yourself.
What MailerLite and Moosend users should check
We could not find a current MailerLite or Moosend help page stating exactly which messages carry the one-click headers, so run the header check above on a real campaign from each account you use.
Moosend documents a related issue: some security systems process the List-Unsubscribe header or click every link before delivery, and Moosend describes a double opt-out confirmation step, reasoning that most automated scanners do not complete multi-step actions. [6] Be aware of the trade-off: a confirmation page applies to the in-email link, while the header-based one-click POST is designed to complete without further action. [1] [6]
Checklist
Run this once per sending platform, and again after any template or domain change.
- Your sending domain has SPF, DKIM and DMARC; the DKIM signature covers the unsubscribe headers. [1] [2]
- Every marketing email shows both headers and a visible footer link. [2]
- Unsubscribes are applied within 48 hours (Gmail recommendation) and 2 days (Yahoo requirement). [3] [4]
- Transactional email is separated from marketing so receipts are not unsubscribed. [3]
- You review unexpected unsubscribes from corporate domains for scanner activity before re-adding anyone, and only with the person's confirmation. [6]
- Your spam rate stays below 0.3% in Postmaster Tools, with Google's best-practice target under 0.1%. An easy unsubscribe helps keep complaints down. [2]
Questions before you decide
Does one-click apply to receipts and password resets?
No. Google's FAQ says one-click unsubscribe is required only for marketing and promotional messages; transactional messages are excluded.
Is the footer link still needed?
Yes. Google says the message body must also include a visible unsubscribe link, in addition to the header.
Does a mailto: unsubscribe count?
Not for Gmail: its FAQ says mailto links do not meet its one-click requirement and asks for one HTTPS URL in the List-Unsubscribe header. Yahoo says the mailto method is acceptable but highly recommends the POST method from RFC 8058.
Why did a subscriber unsubscribe without clicking?
Moosend reports that some aggressive security systems process the List-Unsubscribe header or click every link before delivery. Its suggested fixes include restoring the contact (changing the status back to active or sending a new opt-in request) and asking the recipient's IT team to allowlist the sending, tracking and unsubscribe domains.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- RFC 8058: Signaling one-click functionality for list email headers Accessed 29 Oct 2026
- Gmail Help: Email sender guidelines Accessed 29 Oct 2026
- Gmail Help: Email sender guidelines FAQ Accessed 29 Oct 2026
- Yahoo Sender Hub: Sender best practices and requirements Accessed 29 Oct 2026
- Gmail Help: Trace an email with its full headers Accessed 29 Oct 2026
- Moosend blog: Unsubscribes from security bots (February 6, 2026) Accessed 29 Oct 2026
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.