One-click unsubscribe for cold email

What do the one-click headers mean?

RFC 8058 defines a way for receiving mail systems to submit a one-click request. The message includes an HTTPS unsubscribe URL and a declaration that the endpoint supports the mechanism. The following is an illustrative header shape; the token is a placeholder, not a functioning opt-out link.

List-Unsubscribe: <https://followkite.com/api/u/EXAMPLE_TOKEN>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

A participating receiver submits a POST with the one-click value. The standard also specifies DKIM protection for the relevant headers. An ordinary GET request must not be confused with that POST: link-scanning systems may open URLs before a recipient takes action.

How do sender requirements differ from legal opt-outs?

Mailbox-provider rules and commercial-email law are different layers. Google's sender guidelines require one-click support for marketing and subscribed messages from senders above its bulk threshold. Yahoo's sender requirements also cover easy opt-out and timely processing for bulk senders. Recheck both sources for the audience you send to.

Separately, the FTC's CAN-SPAM guidance explains commercial-message obligations such as accurate sender details, a postal address and a clear opt-out. Adding a header does not establish permission to contact someone, satisfy every local rule, or replace the visible message content.

How does Followkite process an unsubscribe?

Followkite generates a signed link tied to a workspace and recipient address. Opening that link in a browser shows a confirmation page. Submitting the confirmation, or receiving a valid provider one-click POST, suppresses the address. The signed target prevents an unsubscribe request from being repointed to a different recipient by simply editing the URL.

Suppression is broader than pausing one enrollment: the address is placed on the workspace's do-not-contact list, active enrollments stop, and queued campaign jobs are cancelled. A message already dispatched cannot reliably be recalled. Unsubscribes should remain suppressed when lists are re-imported or campaigns are rebuilt.

How do you test the full opt-out workflow?

1. Use a controlled test address. Put it in a test campaign rather than sending a new experiment to a real prospect.
2. Inspect the received original. Verify that both headers are present and that the URL uses your public HTTPS application domain.
3. Check the visible body. Confirm the unsubscribe link is clear and the sender's business details are accurate.
4. Open the browser link. Followkite should display the confirmation before the action is submitted.
5. Confirm the opt-out. Check the do-not-contact list, enrollment status and remaining queued sends.
6. Check future imports. A fresh list or a different sender in the same workspace must not bypass suppression.

Which mistakes can break an otherwise good opt-out?

Do not replace signed URLs with a generic homepage, require an account login, or remove suppression during a contact cleanup. Keep the public domain and signing configuration stable enough that links from older messages continue to work. If a domain migration changes routing, test an old received email as well as a newly generated one.

Also separate transactional messages from outreach. A user-requested password reset is not an excuse to send promotional follow-ups after a campaign opt-out. Review the actual purpose of each workflow and keep campaign suppression intact. If someone directly asks not to be contacted, honor the request even when they did not use the provided link.