One-click unsubscribe headers: test the request and suppression outcome

Define the decision

A visible unsubscribe link and one-click header processing are different interfaces. A link that opens a preference page does not prove that a mailbox provider’s one-click POST can suppress the recipient.

Work through the procedure

1. Inspect the original received message for List-Unsubscribe and List-Unsubscribe-Post.
2. Confirm the HTTPS target belongs to the intended unsubscribe flow.
3. With a controlled test contact, exercise the expected POST and inspect the resulting suppression.
4. Verify later eligible campaign steps cannot contact that address.

Worked example

The following is a synthetic example for this procedure, not a customer result or performance benchmark.

Illustrative header pair:
List-Unsubscribe: <https://example.com/unsubscribe/opaque-token>
List-Unsubscribe-Post: List-Unsubscribe=One-Click
Expected POST body: List-Unsubscribe=One-Click
These example URLs are not production endpoints.

Read the result

The endpoint outcome is the important evidence. RFC 8058 also specifies DKIM protection for the relevant headers; inspect the actual signed message instead of assuming arbitrary added headers are sufficient.

Check before moving on

1. Test without requiring the recipient to log in.
2. Keep opaque recipient tokens out of public screenshots.

Limits and next action

Do not trigger real unsubscribe URLs during an audit of unrelated contacts. Use a controlled record and confirm the deployed sender’s implementation before claiming support.

Source: RFC 8058: one-click unsubscribe