One-click unsubscribe is a standardized way for an email client to let a recipient opt out of further mail in a single click, without opening a web page or replying. For cold email, it means every message carries a header that a Gmail or Yahoo inbox can turn into an unsubscribe button, and increasingly it is a requirement rather than a nice-to-have.
This page covers the RFC 8058 standard behind it, the List-Unsubscribe header's mailto versus https forms, and the List-Unsubscribe-Post header. It also covers Gmail and Yahoo's bulk sender requirement, the processing deadline both state, and whether a cold email sender below bulk volume actually needs it. It sits under our CAN-SPAM Act guide, which covers the US legal opt-out requirement this technical mechanism satisfies.
What is one-click unsubscribe in cold email?
One-click unsubscribe is a mechanism defined in RFC 8058 that lets an email client unsubscribe a recipient from a sender's mail with a single click, handled entirely in the background without the recipient visiting a website or confirming anything further. The client sends an HTTPS POST request to a URL the sender's message itself provides, and the sender's system processes it automatically.
The RFC's own stated motivation is that older List-Unsubscribe links, which just opened a webpage, could be triggered accidentally by anti-spam software fetching URLs in header fields. That forced senders to add a confirmation step, which made unsubscribing more than one click. One-click unsubscribe solves that by using a POST request instead of a simple link, which automated scanners do not trigger by accident.
What is the List-Unsubscribe header, and what is List-Unsubscribe-Post, in cold email?
The List-Unsubscribe header names where to send an unsubscribe request, and the List-Unsubscribe-Post header signals that the request can be handled with a single click rather than a confirmation page. Both sit in the message header, invisible in the body, and most major email clients read them to render an unsubscribe option directly in the inbox UI.
Per RFC 8058, a one-click-compliant message needs both headers, and the message itself needs a valid DKIM signature covering at least these two headers:
List-Unsubscribe: <https://example.com/unsubscribe/opaquepart>
List-Unsubscribe-Post: List-Unsubscribe=One-Click
The List-Unsubscribe header can also include a mailto: address alongside or instead of the https link, which is the older form defined in RFC 2369. When an email client sees the List-Unsubscribe-Post header paired with an https URI, it sends an HTTPS POST with the body List-Unsubscribe=One-Click to that URL. No cookies or other browsing context travel with the request, by design, so the unsubscribe is handled as a standalone action.
What is the difference between a mailto and an https List-Unsubscribe header in cold email?
A mailto List-Unsubscribe sends an email to request removal, while an https List-Unsubscribe with List-Unsubscribe-Post triggers an automatic one-click POST request the recipient's mail client handles without sending anything. Only the https form, paired with List-Unsubscribe-Post, qualifies as true one-click unsubscribe under RFC 8058.
| Form | How it works | Counts as one-click under RFC 8058 |
|---|---|---|
mailto: only | Client composes and sends an unsubscribe email | No |
https:// link, no List-Unsubscribe-Post | Opens a webpage, may need confirmation | No |
https:// link with List-Unsubscribe-Post | Client sends an automatic POST, no page visit | Yes |
A message can include both a mailto and an https URI in the same List-Unsubscribe header. Yahoo's sender best practices, opened October 2026, states the POST method under RFC 8058 is "highly recommended" and the mailto method is "acceptable" as a fallback, which is why many senders include both.
Do Gmail and Yahoo require one-click unsubscribe for cold email?
Gmail and Yahoo require one-click unsubscribe specifically from senders they classify as "bulk senders," meaning those sending 5,000 or more messages a day to their personal accounts, not from every sender. Per Google's email sender guidelines, opened October 2026, senders crossing that threshold "must support one-click unsubscribe, and include a clearly visible unsubscribe link in the message body." Yahoo's own sender best practices list the same requirement for bulk senders. Yahoo states that its List-Unsubscribe header "supports one-click unsubscribe for marketing and subscribed messages," treating it as a requirement, not a suggestion, at that volume.
Google's email sender guidelines FAQ defines a bulk sender as "any email sender that sends close to 5,000 messages or more to personal Gmail accounts within a 24-hour period," counted across the entire primary sending domain, including subdomains. Once a sender crosses that line even once, Google's FAQ states the bulk sender classification is permanent, regardless of later volume changes.
What is the 2-day processing requirement for one-click unsubscribe in cold email?
Google and Yahoo both state a short deadline for honoring an unsubscribe request, though the exact wording differs slightly between them. Google's sender guidelines FAQ lists "unsubscribe requests aren't honored within 48 hours" as a compliance failure for bulk senders. Yahoo's sender best practices state plainly to "honor unsubscribes within 2 days."
Both figures land in the same range, 48 hours versus 2 days, and either reading leaves no real margin for a manual, once-a-week list-cleaning process. A sender relying on bulk senders' requirements being enforced only at scale should still build an automatic, near-immediate unsubscribe process rather than treating the deadline as distant.
Does a cold email sender need one-click unsubscribe, even below the 5,000/day threshold?
A cold email sender below Gmail or Yahoo's 5,000-messages-a-day bulk sender threshold is not required by either provider's published rules to implement one-click unsubscribe. A working opt-out of some kind is still a US legal requirement under CAN-SPAM regardless of volume. Our CAN-SPAM Act guide covers that requirement, which applies to "any email whose primary purpose is commercial advertising," cold outreach included, no matter how small the list.
In practice, one-click unsubscribe is also simply the easiest opt-out to build once, and it removes the risk of crossing the bulk sender line later without the mechanism already in place. Pipefire includes List-Unsubscribe with one-click, using List-Unsubscribe-Post, and a sender postal address on every email it sends, regardless of volume. It also detects and honors reply opt-outs like "take me off your list" automatically.
One-click unsubscribe cold email FAQ
Is one-click unsubscribe a legal requirement for cold email?
Not specifically by name. CAN-SPAM requires a working, easy opt-out for any commercial email, but it does not mandate the RFC 8058 one-click mechanism itself. Gmail and Yahoo do mandate one-click unsubscribe specifically, but only for senders crossing their 5,000-messages-a-day bulk sender threshold.
What is RFC 8058 for cold email?
RFC 8058 is the IETF standard, published in 2017, that defines how a List-Unsubscribe header can signal one-click functionality using an HTTPS POST request instead of a webpage visit, letting email clients offer an automatic unsubscribe button.
Does Gmail's one-click unsubscribe apply below 5,000 emails a day in cold email?
No. Google's published requirement applies to bulk senders, defined as those sending 5,000 or more messages a day to personal Gmail accounts from the same primary domain. A cold email sender below that volume is not covered by the requirement, though including the header anyway causes no downside.
How quickly do I have to process a cold email unsubscribe request?
Google states 48 hours and Yahoo states 2 days for bulk senders; both are close to the same window. Treating any unsubscribe request as something to process automatically and immediately, rather than on a delay, avoids the question entirely.
Does one-click unsubscribe help cold email avoid the spam folder?
Making it easy to opt out reduces the chance a recipient reports your mail as spam instead, which Google's own sender guidelines describe as a factor in domain reputation over time. One-click unsubscribe itself is not a direct ranking signal Google has published, but the behavior it prevents, spam reports, is.