Unsubscribe requirements: one-click, List-Unsubscribe and two days

What one-click actually means

One-click unsubscribe is not a link that takes one click. It is a mail client operating the unsubscribe on the reader’s behalf without ever opening a browser. The reader presses the unsubscribe control the client shows beside your From name, the client sends an HTTP POST to a URL you put in the headers, and the reader stays where they are. RFC 8058 is the specification, and the requirement it states is that the action be taken with no further interaction from the user.

So there is no confirmation page, because nothing is looking at a page. There is no "are you sure", no preferences screen to choose from, no cookie, no session, and no login. Whatever your endpoint returns is thrown away. The correct response is a bare 200 with an empty or trivial body, and no redirect at all.

That last point is the one worth stating twice, because the reflexive thing to do in any web framework is to redirect to a friendly confirmation page, and a redirect here fails the specification while looking completely healthy in every test a developer is likely to run by hand. A browser follows the redirect and shows a nice page; the mail client that posted the request does not care, and the provider that checked your compliance has already moved on.

The URI has to be https and the endpoint has to accept the POST unauthenticated, so the token in the URL is the only thing identifying the subscriber. Make it long, random and single-purpose, and make the endpoint idempotent, because scanners will post to it more than once.

The headers, and what each one does

Two headers do the work, and a one-click unsubscribe requires both. List-Unsubscribe on its own predates RFC 8058 and offers exits a client may present; List-Unsubscribe-Post is the header that declares the https URI safe to POST to without asking the reader anything further. A message with the first and not the second does not have one-click unsubscribe, whatever the sending dashboard says.

The two-day rule

Google and Yahoo both require that an unsubscribe request be honoured within two days. That is a much shorter clock than the 10 business days the United States CAN-SPAM Act allows, and since the providers enforce theirs by filtering your mail rather than by writing to you, theirs is the one that decides whether you have a problem.

Two days is the outer limit and there is no reason to use it. An unsubscribe is a single row and the send is asynchronous, so the honest implementation removes the address before it answers the request, which makes the window irrelevant. The senders who need the two days are the ones running an export to a spreadsheet and an import back, and that arrangement is also how somebody gets mailed after they left.

What the clock really protects against is the worst complaint there is. A message that arrives after somebody asked to leave does not produce another unsubscribe; it produces a spam button press, from a reader who now believes you ignored them. Those are the complaints that move a complaint rate fastest.

A visible link in the body as well

The headers are not a replacement for the link. Not every client renders an unsubscribe control, a forwarded message loses the client-side affordance entirely, and CAN-SPAM requires a clear and conspicuous explanation in the message of how to opt out. So every commercial email carries both: the headers for the clients that support them and a visible link in the footer for everybody else.

Write the link as plain text rather than as part of an image, keep the word "unsubscribe" in it because that is the word people search a message for, and put it where a thumb lands rather than in six-point grey. A hidden unsubscribe does not reduce unsubscribes. It converts them into spam complaints, which cost roughly a hundred times more, because the threshold you are measured against is 0.3% of delivered mail with 0.1% as the target.

And the link must never require a login. An unsubscribe behind a sign-in is an unsubscribe that half the people who want it cannot complete: the address was signed up in one session on a phone, there is no password, and the person pressing the button does not want an account, they want the mail to stop. The token in the URL is the authentication, and the only thing it should authorise is leaving.

Offer pause beside leaving, not instead of it

The one thing worth adding to an unsubscribe page is an alternative that is not leaving. A pause for a month, a switch to one email a week, or a way to finish a course later are all cheaper for the reader than going, and a share of people who clicked unsubscribe out of momentary irritation will take one of them.

The rule is that these sit beside the exit rather than in front of it. The unsubscribe has to have already happened, or be one obvious button on the same screen, with the alternatives offered underneath. A page that presents choices and no exit is the dark pattern that produces spam complaints, and it is also the shape that fails both the CAN-SPAM requirement and the providers’ own.

The reason picker is the earliest warning you get

If you offer one optional question on the unsubscribe page, make it the reason, and make sure one of the options is "I never signed up for this". That option is the single most valuable line of feedback in the whole system, because it is the only place a sender ever learns about a consent failure before the mailbox providers learn about it.

Read it as an early spam-complaint signal rather than as a comment. One selection in a month is somebody who forgot. A cluster of them in a week means addresses are entering your list without their owners asking: a form being filled in by bots, an import somebody did not mention, a partner sending you addresses that were collected for something else. Every one of those people who does not find the unsubscribe will press the spam button instead, and that arrives with no explanation attached.

Keep the question optional and never make an answer a condition of leaving. The requirement is that the unsubscribe take no further interaction, and a compulsory survey is further interaction.