Gmail and Yahoo want one-click unsubscribe on bulk mail, so the email API I build now adds List-Unsubscribe and List-Unsubscribe-Post: List-Unsubscribe=One-Click to each email that has one recipient. The url ends in a token that's just the org id and the recipient address, base64url'd, with an HMAC on it. So I don't store anything when sending and you can't change the address in it to unsubscribe somebody else. The mail client POSTs to it, the address goes on a suppression list, and bulk sends skip it after that. But I also made GET unsubscribe straight away, with a little "you have been unsubscribed" page and no button. Then I read RFC 8058 again and it says GET shouldn't do that, because anti-spam stuff fetches urls from headers by itself. Has anyone actually seen that happen with the List-Unsubscribe url? Like people getting unsubscribed who never clicked anything? submitted by /u/kumard3 [link] [comments]