Skip to content
notspoofed.comSPF · DKIM · DMARC

One-Click Unsubscribe Checker

Paste the headers of an email you sent. You’ll get every RFC 8058 check Gmail and Yahoo apply — including the one that silently breaks one-click for senders who think they are compliant.

Use a message you sent. Paste the whole thing if you like — the body is ignored. Nothing you paste is stored.

What this checks

Since February 2024, Gmail and Yahoo have required bulk senders to support one-click unsubscribe. The mechanism is two headers: a List-Unsubscribe carrying an HTTPS URL, and a List-Unsubscribe-Post whose value tells the receiver the URL will accept a POST. When both are present and trusted, the mail client shows its own unsubscribe control next to your name — which is the control a recipient reaches for instead of the spam button.

The failure almost nobody catches is the third condition. RFC 8058 requires both headers to be covered by your DKIM signature, because an unsigned header can be rewritten in transit to point somewhere else. Receivers enforce it by ignoring the button entirely. Nothing bounces, nothing is logged, and your own tests all pass — the feature is simply never offered, and the first sign of trouble is a rising spam-complaint rate. Checking it means reading the h= tag of every DKIM-Signature on the message, which is why a tool that only looks for the headers cannot tell you.

Beyond the headers, an endpoint can be wrong in ways only a real request reveals: answering GET but not POST, redirecting to a confirmation page, or taking longer than a receiver will wait. Providers send one POST and do not follow redirects. The optional live test sends exactly that request, so you see what they see.

Common questions

Does this apply to transactional email?
No. The Gmail and Yahoo requirements target bulk and promotional mail. A password reset, a receipt or a shipping notification is not something a recipient should be able to unsubscribe from, and adding List-Unsubscribe to it is a mistake. The line is about the nature of the message rather than the system that sent it — the same platform can send both, and only the marketing side needs these headers.
What is the 5,000 a day threshold?
Google applies its strictest bulk-sender rules to domains sending more than 5,000 messages a day to Gmail addresses. It is counted per sending domain, across all the systems you send from, and once you cross it you are treated as a bulk sender from then on. Yahoo published equivalent rules without naming a number. In practice the threshold matters less than it sounds: one-click unsubscribe, DKIM and a DMARC record are worth having well below it, and spam-rate enforcement applies regardless.
Is an unsubscribe link in the footer enough?
Not on its own. The requirement is for a one-click header that lets the mail client show its own unsubscribe control next to your name, without opening your message. A footer link is still expected and still useful, but it does not satisfy the header requirement, and a recipient who cannot find it is far more likely to press the spam button — which costs you far more than the unsubscribe would have.
How quickly do I have to process an unsubscribe?
Within two days. Google and Yahoo both require bulk senders to honour an unsubscribe request within 48 hours. Your endpoint does not have to complete the removal during the request itself — returning 200 immediately and queueing the work is fine, and is what a slow endpoint should do — but the recipient must actually stop receiving mail inside that window.
Can the live test unsubscribe someone by accident?
Yes, and that is why it is off by default and behind an explicit warning. The test sends exactly what a mailbox provider sends: a POST carrying List-Unsubscribe=One-Click to the URL in your header. If that URL contains a real subscriber token, that subscriber is unsubscribed. Use headers from a message you sent to a test address of your own.
Do you store the headers I paste?
No. They are parsed in memory to produce the result and are never written to disk or to a database. The structured result — the pass and fail states, without your headers — is stored for 90 days so a permalink can be shared, and nothing else is kept. The privacy page sets out exactly what that record contains.

Fixing a specific failure