RFC 8058 — One-click unsubscribe

RFC 8058 defines one-click unsubscribe. It is on this list for an operational reason rather than an authentication one: since 2024 the major mailbox providers have required it of bulk senders at the same time as they began requiring DMARC.

If you are working through a sender-requirements checklist — the one covered in SPF, DKIM & DMARC — this is the item next to DMARC on it.

What it actually requires

The older List-Unsubscribe header (RFC 2369) could carry a mailto: or an https: URL, but following the link often led to a preference page demanding a login. RFC 8058 adds a second header that commits the sender to acting on a single request with no further interaction:

List-Unsubscribe: <https://example.com/unsub?id=abc123>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

The mail client sends an HTTP POST to that URL. No confirmation page, no login, no “are you sure”. The List-Unsubscribe-Post header is the part that signals one-click support — the URL alone is not enough.

Why it sits beside DMARC

Both are bulk-sender requirements, and both are checked the same way: by the receiving provider, silently, with the consequence being reduced delivery rather than an error you can see.

A domain can be perfectly authenticated — SPF, DKIM and DMARC all aligned — and still have mail throttled for failing an unsubscribe requirement. The reverse is also true. They are independent checks that happen to have arrived together, and conflating them wastes time in both directions.

What it means in practice

If you send bulk mail, implement it and make sure the POST endpoint genuinely unsubscribes without further steps. If you only send transactional mail, it does not apply — one-click unsubscribe is not expected on a password reset.

It has no relationship to your DNS records, and nothing about it appears in DMARC reports.

Read it: rfc-editor.org/rfc/rfc8058