One-click unsubscribe: what Gmail and Yahoo ask of senders

Most small businesses think of unsubscribing as a link in a newsletter’s footer. Since 2024, Gmail and Yahoo have asked bulk senders for more: two lines in each marketing email’s headers that let a reader leave your list with one click, without opening your website.

This guide explains what those lines are, what Gmail and Yahoo require and of whom, and how to check and test your own email, with a bike shop’s newsletter as the example. It works in any email tool.

What one-click unsubscribe is

Two email headers do the work, defined in RFC 2369 and RFC 8058, both read on October 10, 2026.

List-Unsubscribe is the older one. RFC 2369, from 1998, says it “describes the command (preferably using mail) to directly unsubscribe the user (removing them from the list).” Gmail and Yahoo Mail use it to show their own Unsubscribe link at the top of a message.

RFC 8058 explains its flaw: “anti-spam software often fetches all resources in mail header fields automatically, without any action by the user.” To avoid unsubscribing people by accident, senders put a confirmation page behind the link, which made leaving “more complex than a single click.”

List-Unsubscribe-Post is the fix, from 2017. The sender puts both headers in the message, as in the RFC’s own example:

List-Unsubscribe: <https://example.com/unsubscribe/opaquepart>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

When a reader clicks Unsubscribe in their mail program, the program sends a POST request carrying List-Unsubscribe=One-Click to that address, and the sender removes them, with no page to open. A sender that unsubscribes only on that POST is safe from filters that merely fetch the address.

RFC 8058’s rules, for checking your own email:

• The List-Unsubscribe header “MUST contain one HTTPS URI,” and List-Unsubscribe-Post must contain exactly List-Unsubscribe=One-Click.
• A valid DKIM signature must cover both headers. Without one, the receiving system “SHOULD NOT offer a one-click unsubscribe for that message.”
• The address must identify the reader and the list on its own, and should include “an opaque identifier or another hard-to-forge component,” so nobody can unsubscribe your readers by guessing.
• The sender’s server “MUST NOT return an HTTPS redirect.”

The RFC also says why a sender should care: “if an unsubscription process is too difficult, the recipient’s alternative is to report mail from the sender as junk.”

The header’s one click and the footer link are different

The header’s one click is drawn by the mail program, beside your name, and removes the reader from that list with one request and no page. The footer link is yours, in the body of the email, and opens a page in a browser.

You need both. Google’s FAQ says a mailto address or a link in the body does not meet its one-click requirement, and Yahoo’s FAQ says a link in the body is not sufficient (both read on October 10, 2026). Both also want a clearly visible link in the body, and that link may lead to a page of preferences.

If it does, keep a way to leave everything on that page. The FTC’s CAN-SPAM guide for business (read on October 10, 2026) asks every marketing email for a clear way to opt out. It lets you offer a menu of message types, “but you must include the option to stop all marketing messages from you,” and asks nothing more of the person than “sending a reply email or visiting a single page on an Internet website.”

Who it applies to: Gmail’s and Yahoo’s rules

Google’s email sender guidelines and Yahoo’s sender requirements, with the two FAQs above, all read on October 10, 2026, set these rules for bulk senders. The one-click rule covers marketing and promotional email.

Rule	Gmail	Yahoo
Who is a bulk sender	Anyone sending “close to 5,000 messages or more to personal Gmail accounts within a 24-hour period,” counted per domain, and permanent once reached	Senders of “a significant volume of mail”; Yahoo will “not specify a volume threshold”
The header	One click as in RFC 8058; a mailto address alone does not count	RFC 8058’s POST is “highly recommended” and mailto “acceptable”
Honor an unsubscribe within	48 hours	2 days
Spam complaints	Under 0.3%, and Google advises under 0.1%	Under 0.3%

Gmail says it does not reject a message or mark it as spam only because one-click is missing; a bulk sender that misses it, or takes longer than 48 hours to honor an unsubscribe, loses Google’s help with delivery problems. Yahoo says mail that misses its requirements “may be sent to the spam folder or rejected.” Yahoo’s rules cover every consumer email brand it hosts, AOL included.

In the United States, the FTC’s guide gives you longer: “You must honor a recipient’s opt-out request within 10 business days.” The two mailbox companies ask for two days, so work to theirs.

A small sender should do this anyway. A newsletter to a couple of thousand people a month is far below 5,000 a day, but both companies hold every sender, bulk or not, to a spam rate under 0.3%, and a reader who cannot leave easily reports you instead. Gmail counts every message your domain sends to personal Gmail accounts, so a growing list or one large announcement can make you a bulk sender for good. And both show their own Unsubscribe link only when the headers are right and your sending has a good record.

What to check in your own sending tool

Check these on an email you actually sent, not on the editor’s preview.

1. Both headers on every marketing email, automated series such as a welcome series included.
2. A footer link a person can find, leading to one page that works without signing in. If the page offers choices, one of them stops everything.
3. Unsubscribes honored within two days, and sooner if you can. If you schedule emails ahead, the tool should check the list again when it sends, not only when you scheduled.
4. The unsubscribe kept by address, not on the contact. If it is a flag on the contact, deleting the contact deletes it, and a later import brings the person back. Keep a list of unsubscribed addresses that no import or deletion touches.
5. No “sorry to see you go” email. RFC 8058 notes that a mail system may send the one-click request when a person reports your message as junk, so your goodbye may reach someone who has reported you. Show a short confirmation on the page instead.
6. Old links that still work. The FTC wants an opt-out to work “for at least 30 days after you send your message,” and Google says a link broken for an extended time no longer meets its requirement, so keep them working when you change tools.

Unsubscribing is the far end of a list that starts with consent, and double opt-in covers who should get on it. If you are choosing a new tool, the small-team CRM buying checklist asks about both in its marketing email questions.

How to test it

You need a Gmail address of your own. Google’s help pages on checking authentication and viewing the full header, read on October 10, 2026, describe the screens.

1. Join your own list through your real sign-up form, so the test address is a subscriber like any other.
2. Open your next newsletter in Gmail on a computer. Look beside the sender’s name for Unsubscribe. If it is missing, that alone does not mean your headers are wrong: Google shows it “only for messages that pass Google’s automated eligibility checks.”
3. Check the signature. Click the down arrow below the sender’s name. “Signed by” should show your own domain.
4. Read the headers. Next to Reply, click More, then Show original, and search for “unsubscribe” to find both headers. The DKIM-Signature’s h= list should name list-unsubscribe and list-unsubscribe-post, and Authentication-Results should say dkim=pass.
5. Unsubscribe the test address, then check that your tool shows it as unsubscribed and that nothing more arrives.
6. Import it again in a spreadsheet and check that it is still unsubscribed.

Yahoo asks senders to test in its own webmail, at mail.yahoo.com. Someone comfortable with a terminal can send the test address’s one-click request by hand, curl -i -d "List-Unsubscribe=One-Click" "<the https address>", and the answer should not be a redirect.

What support replies need

One-click unsubscribe is a rule for marketing email, and both companies exclude transactional mail. Google’s examples are “password reset messages, reservation confirmations, and form submission confirmations,” and Yahoo’s are “order confirmations, password resets.”

Email	One-click unsubscribe
A newsletter, a sale announcement, a welcome series	Yes
A receipt, a booking confirmation, a password reset	No: transactional
Your reply to a customer who wrote to you	No, while it stays a reply

A reply to a customer’s own question is a conversation they started, and what keeps it on the transactional side is what is in it. Google’s FAQ says recipients, not Google, decide what kind of message they received, and its guidelines say “Don’t mix different types of content in the same message.” So keep promotions out of support replies. The fifteen support email templates are written that way: each one answers, and none of them sells.

A worked example: a bike shop’s newsletter

Thistlecog Cycles is an invented five-person bike shop. Greer owns it, and Sol, one of its mechanics, sends the newsletter on the first Thursday of each month to about 1,800 people who signed up on the shop’s website. Even if all of them used Gmail, that is 1,800 messages one day a month, so the shop is not a bulk sender. Sol checks anyway.

Checking a sent message. Sol keeps her own Gmail address on the list, signed up through the shop’s form, and opens the October issue on her laptop. Unsubscribe sits beside “Thistlecog Cycles,” and under the down arrow, “Signed by” shows thistlecog.example. In Show original, a search for “unsubscribe” finds:

List-Unsubscribe: <https://thistlecog.example/unsubscribe/k7Qx2vR9pT>
List-Unsubscribe-Post: List-Unsubscribe=One-Click
DKIM-Signature: v=1; a=rsa-sha256; d=thistlecog.example; s=news;
        h=from:to:subject:date:list-unsubscribe:list-unsubscribe-post; ...

Both headers are there, the address ends in a code rather than her email address, the signature covers both, and Authentication-Results says dkim=pass.

One reader leaves. Marguerite presses Unsubscribe beside the shop’s name in her Gmail. Gmail sends the one-click request to the address in her copy’s header, and the shop’s tool marks her address unsubscribed at 10:42 that morning, noting that it came by one click. She gets no goodbye and no survey, and the November issue goes out without her.

The import. In March, Sol imports the shop’s customer list from its point-of-sale system to bring phone numbers up to date. Marguerite’s address is on it. Her unsubscribe is kept against her address on a list of its own, so the import changes nothing.

How ContactRoll does it

In ContactRoll, every marketing email has one-click unsubscribe, and each person has a page where they choose their topics and how often they hear from you. An unsubscribe is kept by address, so a person who unsubscribed stays unsubscribed even if they are imported again. Marketing email goes only to people with a consent record, and ContactRoll asks again at the moment of sending. Sign-up forms use double opt-in. There is a weekly cap per person, quiet hours where a person’s time zone is known, and sending pauses itself if complaints or bounces climb. Marketing email is sent from your own domain, and ContactRoll checks its SPF, DKIM and DMARC records. Free holds 500 marketing contacts, Standard 2,000 and Plus 10,000 (see pricing). You can start free, with no card.