Add One-Click Unsubscribe Headers to Client Cold Email, Not Just a Footer Line

Most agency cold email handles opt-outs in the body. A line at the bottom says something like "Not the right fit? Reply and I'll stop," and a person in the shared inbox processes the replies. That covers the legal minimum in a lot of cases. It doesn't cover how inboxes now handle unsubscribing.

Gmail and Yahoo both give their users an unsubscribe control outside the message body, and that control is driven by email headers your client's message either has or doesn't. If it doesn't, the easiest button left for an annoyed prospect is "Report spam."

What the headers are

Two headers do the work.

List-Unsubscribe comes from RFC 2369 and holds a URL (or a mailto address) that removes the recipient. List-Unsubscribe-Post comes from RFC 8058, a 2017 standards-track document. It tells the mailbox provider that an HTTPS POST to that URL will unsubscribe the person in one step, with no landing page.

The simplest example in RFC 8058 looks like this:

List-Unsubscribe: <https://example.com/unsubscribe/opaquepart>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

When a user clicks the provider's unsubscribe control, the provider sends the POST on their behalf. The sender never sees a browser visit, just the request.

Why the providers care

RFC 8058 explains the problem it solves in one sentence: recipients "do not make a clear distinction between unsubscription and junk." If unsubscribing is hard, people report the mail as spam instead, and spam reports damage the sending domain.

Google's sender guidelines FAQ says the same thing from the other side. Messages without one-click unsubscribe aren't automatically rejected, but "unwanted messages that don't use one-click unsubscribe are more likely to be reported as spam by recipients." The FAQ also tells senders to keep the user-reported spam rate below 0.1% and never let it reach 0.3%.

Gmail has also made unsubscribing more visible. Since July 2025, in a rollout to select countries, its "Manage subscriptions" view lists a user's subscription senders by how often they email and lets the user unsubscribe in one click, with Gmail sending "an unsubscribe request to the sender on your behalf." Google's FAQ adds that the unsubscribe button next to the sender name only appears for messages that pass its eligibility checks, including correct one-click headers.

Do the rules apply to cold email?

Here's the honest version.

Google's formal requirement is for bulk senders, which it defines as "close to 5,000 messages or more to personal Gmail accounts within a 24-hour period," counted across the primary domain. It applies to "marketing and promotional messages." Yahoo's bulk sender requirements also call for "a functioning list-unsubscribe header" for marketing and subscribed messages, and say the RFC 8058 POST method is "highly recommended."

Most well-run agency cold programs send far below 5,000 a day per client domain, and many prospects use business mailboxes rather than personal Gmail. So the hard requirement often doesn't bite.

I'd still add the headers. Cold outreach is commercial mail by any reasonable reading, and the reason the providers want one-click unsubscribe applies to it even more than to newsletters. The prospect never signed up. If they want out, you want the exit to be the unsubscribe control, not the spam button.

How to set it up per client

The details in RFC 8058 matter, and a few of them trip people up.

1. Sign the headers with DKIM. The RFC says the message "MUST have a valid DomainKeys Identified Mail (DKIM) signature that covers at least the List-Unsubscribe and List-Unsubscribe-Post headers," listed in the signature's h= tag. Without that, the receiver "SHOULD NOT offer a one-click unsubscribe." Check a real sent message's DKIM signature, not the platform's settings page.
2. Make the URL identify the person and the client. One-click has no form, so the URL must carry "enough information to identify the mail recipient and the list." Use an opaque token rather than a plain email address. The RFC recommends a "hard-to-forge component" so nobody can unsubscribe people by guessing URLs.
3. Answer the POST directly. The RFC says the sender "MUST NOT return an HTTPS redirect." The endpoint should accept the POST, record the opt-out, and return success. No confirmation page, no login.
4. Ignore cookies and context. The POST "MUST NOT include cookies, HTTP authorization, or any other context information," so the endpoint can't depend on them.
5. Keep the body opt-out too. Google says body links can still point to a preferences page if the headers are in place. For cold email, a plain "reply and I'll stop" line in the body works alongside the header.
6. Route the opt-out to the right client. In an agency, the token has to map back to one client workspace. An unsubscribe from Client A's prospect should suppress that person in Client A, everywhere that client sends, and nowhere else.

The clock starts at the click

Once the header is live, you need a fast path from POST to suppression. The deadlines differ by source:

• Google recommends fulfilling unsubscribe requests "within 48 hours."
• Yahoo says to "honor unsubscribes within 2 days."
• CAN-SPAM, per the FTC, requires honoring opt-outs "within 10 business days" and keeping the mechanism working "for at least 30 days after you send your message."

The provider timelines are the ones that affect delivery. Build to them. A queued follow-up step that goes out the morning after someone unsubscribed is exactly the email that gets reported.

One more rule from the FTC guide that agencies sometimes miss: once someone opts out, "you can't sell or transfer their email addresses." In practice, that means opt-outs stay with the client they came from. Don't pool them into a shared agency list that feeds other clients' campaigns.

What this changes in the sequence

With the headers in place, three things in the sequence logic should change.

• Stop every remaining step for that client. Email and LinkedIn both. Unsubscribing from step two isn't a request to hear from you on another channel.
• Log the step that triggered it. A cluster of unsubscribes on the same step tells you the copy or targeting on that step needs work.
• Keep the suppression permanent. The same person shouldn't come back in next quarter's list import for that client.

Where GTM fits

In GTM, nothing sends without a compliance verdict and an unsubscribe URL. That's a database constraint, not a setting. Each client works in an isolated workspace with its own connected sending domains and its own suppression list, sequences stop on reply, and suppression survives data purges.

If you run outbound for several clients and want opt-outs kept inside the client they belong to, join the waitlist.

Sources

• RFC 8058, "Signaling One-Click Functionality for List Email Headers": https://www.rfc-editor.org/rfc/rfc8058.html
• Gmail Help, "Email sender guidelines FAQ": https://support.google.com/a/answer/14229414
• Google, "Gmail launches new 'Manage Subscriptions' view" (July 8, 2025): https://blog.google/products-and-platforms/products/gmail/new-manage-subscriptions-unsubscribe/
• Yahoo Sender Hub, "Sender Best Practices": https://senders.yahooinc.com/best-practices/
• Federal Trade Commission, "CAN-SPAM Act: A Compliance Guide for Business": https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business