List-Unsubscribe Header: One-Click Unsubscribe Testing with MailSlurp

A List-Unsubscribe header tells an email app where to send an unsubscribe request. For campaign QA, finding the header is only the beginning: you also need to check that the action removes the correct subscription and that the next campaign respects it.

Use a private MailSlurp inbox as an owned test subscriber. Send through your normal email provider, inspect the delivered message, and follow the change back to the contact's subscription record. Never test with a customer's unsubscribe link.

What the two unsubscribe headers mean

In an RFC 8058 one-click setup, List-Unsubscribe supplies an HTTPS endpoint and List-Unsubscribe-Post identifies the action. This is an illustrative header pair, not a working subscriber URL:

List-Unsubscribe: <https://news.example/unsubscribe/opaque-test-token>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

RFC 8058 requires a valid DKIM signature covering both headers. Check that both names appear in the signature's h= field; header presence alone does not establish a valid signature. Use the receiving service's authentication result alongside that check.

Which Gmail and Yahoo rules apply?

Google's sender requirements apply to personal Gmail accounts. Its bulk-sender rules require marketing and subscribed messages to support one-click unsubscribe and include a visible body link. Bulk senders must configure SPF, DKIM and DMARC; direct mail must align the visible From domain with SPF or DKIM to pass DMARC.

Google's sender FAQ defines a bulk sender as reaching approximately 5,000 or more messages to personal Gmail accounts in 24 hours, counting messages from the same primary domain together. Once assigned, that classification remains.

The FAQ distinguishes promotional mail from transactional messages such as password resets. It also explains that a preference-page link or mailto: link alone does not meet Gmail's RFC 8058 one-click requirement, and recommends honoring requests within 48 hours.

Yahoo's requirements require bulk senders to offer easy unsubscribe and honor requests within two days. Yahoo recommends RFC 8058 POST and also accepts the mailto: method. Its FAQ limits the one-click requirement to promotional or marketing messages and does not publish a fixed bulk-volume threshold.

Keep those scopes separate. A password-reset email and a newsletter serve different purposes. Check the rule for the actual message and receiving provider rather than assuming every email needs the same subscription controls.

Send to an owned subscriber through the normal campaign route

Create a MailSlurp inbox and add it as a subscribed test contact in an isolated audience or list that you control. Note which subscription the campaign belongs to, and verify that the contact is subscribed before sending.

Send the actual campaign to that controlled recipient only. A provider's generic "send test" function can use placeholder unsubscribe links or bypass normal contact processing. Where that happens, use a small, real campaign restricted to your owned test contacts so the delivered link represents a genuine subscription.

For the provider workflow, start with the Mailchimp campaign guide or HubSpot email guide. Check the final recipients before sending, particularly when copying an existing campaign.

Open the received message in MailSlurp. Keep its message ID and inspect the raw source; forwarding it into another mailbox can change the evidence you are trying to inspect.

Inspect the delivered headers before using the URL

Use the email header analyzer to make the fields easier to read. Check the unsubscribe pair, the intended sender and the reported authentication results. The header-reading guide explains why a parser result is different from independently verifying a signature.

Inspect the endpoint's hostname and confirm that it belongs to your ESP or your own unsubscribe service. Use the exact URL from your owned test contact's message. It should identify the intended recipient and subscription without requiring you to add a customer address manually.

Keep recipient tokens out of shared screenshots and public bug reports. They may be enough to change the subscription, even when no password is involved.

Test the POST, not just a browser visit

The one-click action sends a POST whose body is List-Unsubscribe=One-Click. This example shows the request shape for the illustrative URL above:

POST /unsubscribe/opaque-test-token HTTP/1.1
Host: news.example
Content-Type: application/x-www-form-urlencoded
Content-Length: 26

List-Unsubscribe=One-Click

Have the person maintaining the endpoint run that request against the owned test subscriber. It must work without login cookies or HTTP authorization, and RFC 8058 forbids an HTTPS redirect in response. A preferences page requiring another choice is not a completed one-click action. See the protocol requirements.

Opening the URL in a browser normally makes a GET request. That is a different operation and cannot substitute for testing the POST. Do not let a routine link checker unsubscribe real contacts while checking whether URLs are reachable.

Verify the subscription changed

After the request completes, open the contact in your ESP or read its subscription state through your application's normal administration API. Confirm that the subscription associated with this campaign is now unsubscribed or suppressed.

Check the scope as well as the label. If the contact has several subscription types, confirm the intended behavior for this list and your provider's settings. A success response from the endpoint proves that it answered; it does not by itself prove which record changed.

If nothing changes, investigate the recipient token, list mapping and asynchronous processing. Keep the request time and response status with the contact change so you can locate the failed step. Repeatedly clicking unrelated unsubscribe links makes this harder to diagnose.

Check the next campaign's recipient decision

Create a follow-up campaign confined to the same owned test audience. Let the normal subscription and suppression rules run. The unsubscribed contact should be excluded from the relevant campaign; a separate subscribed test contact can serve as a positive control.

Inspect the provider's audience preview and exclusion or send log. If you execute the controlled send, confirm that the subscribed control receives it and that the unsubscribed address was suppressed. Absence from an inbox alone is weak evidence: a failed send could also explain it.

Do not override suppression to force the test through. If you need to repeat the exercise, use a fresh owned subscriber or follow your provider's legitimate resubscription process.

Keep footer, mailbox and campaign checks distinct

Test the visible footer link separately. It should be readable on a phone and take the recipient to the expected unsubscribe or preference action. Use device previews to inspect the delivered layout and Email Audit for other content and link issues.

A mailbox's native Unsubscribe control is another observation. Providers decide when to display it; Yahoo explicitly ties its display to reputation and engagement as well as setup. Its absence in one test message is not enough to diagnose your endpoint.

Finally, run a separate inbox placement test on the campaign. Correct unsubscribe behavior, authentication and observed folder placement answer different questions. Together they help you approve a message that reaches readers and respects their decision to leave.