One-click unsubscribe: leaving a mailing list in a single tap
An email app can offer an Unsubscribe button beside the sender’s name when 2 lines in the email’s headers allow it. Without them, the reader hunts for the footer link.
One-click unsubscribe is a way to leave a mailing list with a single action in the email app, set up by the List-Unsubscribe and List-Unsubscribe-Post headers defined in RFC 8058. The reader never visits a page or logs in, and Gmail and Yahoo require it from bulk senders of marketing email.
On this page
How one-click unsubscribe works
RFC 8058, a Proposed Standard published in January 2017, sets out the mechanism. Every marketing email carries two headers, the lines of technical information above the message that readers rarely see.
- List-Unsubscribe: must contain one HTTPS address for the unsubscribe, and may also hold others such as a mailto address.
- List-Unsubscribe-Post: contains the value List-Unsubscribe=One-Click, which tells the email app it can unsubscribe the reader with a single request.
When the reader taps Unsubscribe, the email app sends that request to the HTTPS address itself. The RFC says the request must not carry cookies or any other context, and the sender must not answer with a redirect. The email must also carry a valid DKIM signature covering both headers.
Who requires one-click unsubscribe
Google’s email sender guidelines apply from 1 February 2024 to anyone sending more than 5,000 messages a day to Gmail accounts. Their marketing and subscribed messages must support one-click unsubscribe and show a clearly visible unsubscribe link in the body. Its sender guidelines FAQ recommends fulfilling unsubscribe requests within 48 hours and says transactional messages are excluded. Yahoo’s sender best practices ask bulk senders for a working list-unsubscribe header that supports one-click unsubscribe, and to honour unsubscribes within 2 days.
The law sets its own floor. In the US, the FTC’s CAN-SPAM compliance guide says senders must honour an opt-out within 10 business days. The opt-out must keep working for at least 30 days after the message is sent. This is general information, not legal advice.
How one-click unsubscribe is checked
By hand, a CRM or deliverability lead opens a message’s raw source (Show original in Gmail) and reads the 2 headers and the DKIM result. Then they tap Unsubscribe and watch the inbox for anything that still arrives.
Obsession collects what companies show only to customers, step by step: their screens, emails and texts, member prices, trial limits, quotes and cancel offers, each dated with a screenshot. Teams and AI agents look up any company through the API or MCP, and a company not yet covered is added on request. Because each email is kept raw with its sender checked, its unsubscribe headers and DKIM result sit beside the time it arrived, for your brand and for competitors’. Any email that still arrives after an unsubscribe is kept the same way, the evidence behind opt-out compliance.
For bulk senders to Gmail and Yahoo, no. Both ask for the one-click headers, and Google also asks for a clearly visible unsubscribe link in the message body.
Yahoo asks for 2 days and Google recommends 48 hours. In the US, CAN-SPAM allows up to 10 business days. Other countries set their own rules.
Sources
In the order the page cites them. Every page was read on 11 Nov 2026.