Glossary
One-click unsubscribe
Also called RFC 8058 unsubscribe.
Last reviewed 18 September 2026
What is one-click unsubscribe?
One-click unsubscribe is a mail client operating the unsubscribe on the reader’s behalf by POSTing to an https URI the sender put in the message headers, with no browser, no confirmation page and no further interaction from the reader, as RFC 8058 defines it.
There is no “are you sure”, no preferences screen, no cookie, no session and no login, and whatever the endpoint returns is thrown away. The correct response is a bare 200 with an empty or trivial body, and no redirect at all.
The redirect is the failure worth stating twice, because the reflexive thing to do in any web framework is to send the reader to a friendly confirmation page, and a redirect here fails the specification while looking completely healthy in every test a developer runs by hand. A browser follows it and shows a nice page; the mail client that posted the request is not reading the response.
The endpoint accepts the POST unauthenticated, so the token in the URL is the only thing identifying the subscriber. Make it long, random and single-purpose, and make the endpoint idempotent, because scanners will post to it more than once.
See also
- List-Unsubscribe
List-Unsubscribe is a message header offering machine-readable ways out of a list, and paired with a List-Unsubscribe-Post header carrying the value List-Unsubscribe=One-Click it is what a mail client uses to unsubscribe a reader without opening a browser.
- Unsubscribe
An unsubscribe is a reader withdrawing permission to be mailed, and since February 2024 Google and Yahoo have required one to be honoured within two days, a much shorter clock than the 10 business days the United States CAN-SPAM Act allows.
- Bulk sender requirements
The bulk sender requirements are the list Google and Yahoo both began enforcing in February 2024: SPF and DKIM on the sending domain, a DMARC record on the From domain, one-click unsubscribe in the headers, unsubscribe requests honoured within two days, and a spam complaint rate under 0.3 per cent.
Read next
This term is covered properly in Unsubscribe requirements: one-click, List-Unsubscribe and two days, which is a longer piece on the subject.
Every other term is on the glossary index , the longer writing is in the guides, and what this site itself does is on the home page.
Thinking of writing one of these?
5dayemail hosts a five-to-ten day email course: you write it once, and everyone who joins your list gets one email a day, in order, starting from the day they confirm.
Accounts are opened a few at a time rather than by signing up. Leave your address and you will be written to when the next ones open.
One message, when there is room. No course emails, no newsletter, and the address is not passed on. Ask and it is deleted; what is kept, and for how long, is in the privacy policy.