RFC 8058: The One-Click Unsubscribe Standard, Defined
RFC 8058 — "Signaling One-Click Functionality for List Email Headers," published January 2017 — is the IETF standard that defines true one-click email unsubscribe. A compliant sender adds a List-Unsubscribe-Post: List-Unsubscribe=One-Click header next to an HTTPS List-Unsubscribe URI, and a mail client unsubscribes the reader by sending a single POST request to that URI. No login. No confirmation page. No exit survey.
The quotable version: RFC 8058 is the standard that lets your mail client unsubscribe you from a mailing list with one HTTPS POST request — no login wall, no confirmation page, no human interaction required.
What does RFC 8058 actually require?
Four normative things, per RFC 8058:
- The
List-Unsubscribeheader must contain one HTTPS URI. - The
List-Unsubscribe-Postheader must contain the single key/value pairList-Unsubscribe=One-Click— nothing else. - The POST must complete the unsubscribe without manual intervention. The spec is explicit: it must work "without requiring that software attempt to interpret the contents of a confirmation page." A login wall breaks compliance.
- The sender must apply at least one valid DKIM signature covering both headers, so nobody can inject a fake unsubscribe URI.
One deliberate wrinkle: the mail client must get the reader's consent before firing the POST. That is why one-click unsubscribe is a button you press, not something that happens to you.
How is RFC 8058 different from the List-Unsubscribe header?
RFC 8058 builds on the original List-Unsubscribe header, defined in RFC 2369 back in July 1998.
| List-Unsubscribe (RFC 2369) | One-Click (RFC 8058) | |
|---|---|---|
| Published | 1998 | 2017 |
| Defines | Header listing mailto: and/or http unsubscribe URIs |
A signal that the HTTPS URI accepts an automated POST |
| What a click does | Opens a link or drafts an email — anything can be on the other side | Completes the unsubscribe, full stop |
| Login or confirmation page | Allowed | Not allowed |
| DKIM signature | Not required | Required, covering both headers |
The practical difference: under RFC 2369 alone, "unsubscribe" is a promise to show you a webpage. Under RFC 8058, it is the unsubscribe.
Why did RFC 8058 suddenly matter in 2024?
Because the mailbox providers turned an optional standard into a delivery requirement. Google's sender guidelines require senders of 5,000+ messages a day to Gmail accounts to support one-click unsubscribe in marketing messages, effective February 1, 2024; senders that already had an unsubscribe link got until June 1, 2024 to add it. Google also tells bulk senders to keep spam rates below 0.3% and recommends fulfilling unsubscribe requests within 48 hours.
Yahoo's sender requirements landed in the same window: a functioning list-unsubscribe header for marketing mail, unsubscribes honored within two days, and a spam rate below 0.3%. Miss the bar and your mail trends toward the spam folder. A standard that sat mostly unimplemented for years became table stakes in one quarter.
For the full history and mechanics, see our long report: one-click unsubscribe, explained.
Does every sender support RFC 8058?
No. The mandates bind bulk senders into Gmail and Yahoo; smaller senders still ship only a mailto: link or a hosted preference page. And a compliant header is a promise, not a guarantee — the gap between "accepted your unsubscribe" and "stopped emailing you" is real and measurable; see our unsubscribe statistics.
How does Flick handle RFC 8058?
We build List-Unsubscribe parsing for a living, so this part is short. When you swipe to unsubscribe in Flick (flicked.email), we read the sender's headers. If they support RFC 8058, we fire the one-click POST — the same mechanism behind Gmail's native unsubscribe button. If not, we fall back to the List-Unsubscribe URI. And because an accepted POST is not a kept promise, our Exit Gap Index grades real senders A–F on whether they actually honor unsubscribes.
Stop reading your inbox. Start flicking it.
Flick turns every inbox into a finite swipe deck — archive, "no reply needed," or AI-draft → approve, one card at a time. Inbox flicked.
Try the live demo — no signup →FAQ
Is RFC 8058 legally required?
No — RFC 8058 is an internet standard, not legislation. But Gmail and Yahoo made one-click unsubscribe a condition of bulk delivery to their inboxes in February 2024, which in practice moves senders faster than most laws do. Gmail's guidelines name the RFC 8058 headers directly; Yahoo calls the POST method "highly recommended."
What is the List-Unsubscribe-Post header?
The List-Unsubscribe-Post header is the signal defined by RFC 8058 that a sender supports one-click unsubscribe. It must contain exactly List-Unsubscribe=One-Click, and it tells the mail client that the HTTPS URI in the List-Unsubscribe header will accept an automated unsubscribe POST.
Why does RFC 8058 require a POST instead of a GET?
Because security software opens links in email, and a GET that unsubscribes would unsubscribe people who never asked. RFC 8058 is designed so automated URL-fetching cannot trigger an accidental unsubscribe; only a deliberate POST does.
Does one-click unsubscribe work with mailto: links?
No. mailto: unsubscribe comes from RFC 2369 and requires sending an email; RFC 8058 is specifically an HTTPS POST. Mail clients — Flick included — fall back to the plain List-Unsubscribe URI when a sender does not support RFC 8058.
How fast must senders honor an unsubscribe?
Yahoo requires unsubscribes to be honored within two days, and Google recommends fulfilling them within 48 hours. What senders actually do varies widely — which is exactly the gap the Exit Gap Index measures.