How one-click unsubscribe works, and the timing Gmail, Yahoo and the FTC expect

An unsubscribe link in the footer of an email is not enough on its own under Google's rules for senders at volume. Google and Yahoo expect marketing and subscribed messages to carry a header-based, one-click unsubscribe that the mailbox provider can act on directly.

Three sets of rules apply at once: the technical standard (RFC 8058), the mailbox providers' bulk-sender requirements, and the US CAN-SPAM Act. They differ on what counts as an unsubscribe, how fast it must be processed and what happens when a sender fails.

Google's stricter requirements apply to senders of roughly 5,000 or more messages a day to personal Gmail accounts, while the CAN-SPAM Act applies to commercial email regardless of volume. A sender can meet one set of rules and still miss another.

What the one-click mechanism consists of

RFC 8058, published in January 2017, defines two headers. The List-Unsubscribe header must contain one HTTPS address and may also list others, such as a mailto address. The List-Unsubscribe-Post header must contain exactly the pair "List-Unsubscribe=One-Click".

When a recipient uses the provider's unsubscribe control, the provider sends an HTTPS POST to that address. The body of the request carries the same key and value. The RFC says the body should use multipart/form-data, though application/x-www-form-urlencoded is also allowed. Google's documentation gives the same two-header setup.

The RFC also says receivers must not send the POST without user consent. How that consent is collected is outside the specification.

The message must carry a valid DKIM signature that covers both headers and lists them in the signature's h= tag. Under the RFC, a receiver should not offer one-click unsubscription for a message that lacks this.

The RFC limits the POST body to one fixed key and value. It states that this stops an attacker from using the request to simulate arbitrary form submissions.

Details of the unsubscribe endpoint that senders often miss

RFC 8058 says the POST must not include cookies, HTTP authorization or other context that links it to earlier web activity. The unsubscribe address therefore has to identify the subscriber on its own.

The RFC advises senders to put an opaque, hard-to-forge component in the address and to verify it on the server. That check helps confirm the request came from a message the sender actually sent, and it deters attackers who try to trigger unsubscriptions for other people.

The endpoint must not answer with an HTTPS redirect. The RFC explains that redirected POST actions have historically not worked reliably and that many browsers have turned redirected POSTs into GETs.

The RFC also notes that a successful unsubscribe can hint that an address is valid.

Yahoo adds that the unsubscribe process should be obvious and visible and should not require users to log in.

Which messages and which senders are covered

Google applies the requirement to marketing and promotional messages. Transactional messages such as password resets and reservation confirmations are excluded. Google separately advises against mixing content types, such as promotions inside sales receipts, and recommends separate From: addresses for each message category.

A bulk sender, in Google's definition, is one that sends roughly 5,000 or more messages to personal Gmail accounts within 24 hours. Messages from the same primary domain are counted together. Once a sender reaches the threshold, Google says the status is permanent and changing sending practices does not remove it.

Google's guidelines say that starting February 1, 2024, all senders to Gmail accounts must meet its baseline requirements, and the stricter ones apply above 5,000 messages a day. Senders that already had unsubscribe links had until June 1, 2024 to add one-click support. Google also says Gmail began ramping up enforcement in November 2025, including temporary and permanent rejections of non-compliant messages. Enforcement is gradual, and new domains face a faster timeline.

The same requirements cover authentication. Google asks bulk senders for SPF, DKIM and DMARC, with the From: domain aligned to SPF or DKIM. Yahoo asks senders for DKIM and a passing DMARC policy of at least p=none. Both set a minimum DKIM key of 1024 bits, and Google recommends 2048.

Yahoo's sender best-practices page sets no message count for its unsubscribe rules. Its numeric limit is a spam complaint rate below 0.3% for bulk senders. Google requires a user-reported rate below 0.30% in Postmaster Tools and advises staying under 0.10%.

What counts as compliant, and what does not

Google states that mailto links and URL unsubscribe links do not meet the one-click requirement. Mailto links remain supported but do not qualify.

Yahoo takes a looser line on method. It highly recommends the POST method. It also requires a clearly visible unsubscribe link in the email body, which may lead to a preference page.

Google allows the same arrangement once the headers are present: extra body links need not be one-click and can point to a preferences page. A body link alone, without the headers, does not satisfy the requirement.

A one-click unsubscribe removes the recipient only from the mailing list tied to that message, not from every message the sender distributes, according to Google.

A link in the email body alone does not satisfy Google's one-click requirement; the headers do.

How fast the unsubscribe must be processed

Yahoo's best-practices page says requests should be processed within 2 days. Google recommends fulfilling requests within 48 hours. Google words this as a recommendation, not a fixed rule.

The legal deadline is longer. The FTC's CAN-SPAM guide requires a sender to honor an opt-out request within 10 business days. The opt-out mechanism must keep working for at least 30 days after the message is sent.

The FTC also bars charging a fee for an opt-out and requiring any personal information beyond an email address. Recipients can be asked to reply by email or visit a single web page, and nothing more.

A sender may offer category choices, but the FTC says it must include an option to stop all marketing messages. After an opt-out, the address cannot be sold or transferred, except to a company hired to help with compliance.

The FTC also says subscribers and members keep the right to opt out of marketing email. Having a subscription or membership does not remove that right.

What happens when a sender does not comply

Google says messages without one-click unsubscribe are not automatically rejected or marked as spam. Unwanted messages without one-click unsubscribe are more likely to be reported as spam by recipients, which raises the risk that later messages go to spam folders.

Only bulk senders that meet every requirement, including authentication, spam rate and one-click, are eligible for mitigation. A bulk sender is eligible again once its spam rate has stayed below 0.3% for 7 consecutive days. A broken unsubscribe link over an extended period also removes eligibility.

Under CAN-SPAM, each separate violating email can bring a penalty of up to $53,088, according to the FTC page, which notes the figure was updated in January 2024. The FTC also says certain aggravated violations carry criminal penalties, including imprisonment.

The FTC sets out eight main requirements. Beyond the opt-out rules, they cover accurate header information, non-deceptive subject lines, clear identification of the message as an ad and a valid physical postal address.

CAN-SPAM applies to commercial messages, whose primary purpose is to advertise or promote a product, service or website. Transactional or relationship messages fall into five categories, such as completing an agreed transaction, and are mostly exempt. The FTC says the law views those categories narrowly. For mixed messages, the primary purpose decides.

A sender stays responsible when another company runs its email marketing. Both the company whose product is promoted and the company that sends the message may be held liable.

The first things to check are the headers on a live message, the DKIM signature covering them, an endpoint that accepts a bare POST without redirecting, and a suppression process that completes within the 48 hours Google recommends.