Is using the same URL for both List-Unsubscribe header and body compliant with RFC 8058 for one-click unsubscribe?

Summary

Experts, email marketers, and documentation sources generally agree that using the same URL for both the List-Unsubscribe header and the email body's unsubscribe link is compliant with RFC 8058, as long as the server correctly differentiates between GET and POST requests. The List-Unsubscribe header with a POST request must trigger a silent one-click unsubscribe, while the body link with a GET request should lead to a confirmation page. Tools like aboutmy.email can provide an initial assessment of compliance. Testing the implementation is crucial, and providers like Google and Microsoft require correct handling of POST requests for their one-click unsubscribe features.

Key findings

  • RFC 8058 Compliance: Using the same URL is compliant if GET and POST requests are handled correctly.
  • POST Request: The List-Unsubscribe header requires a POST request for silent one-click unsubscribe.
  • GET Request: The body link should use a GET request and lead to an unsubscribe confirmation page (or preference center).
  • Gmail's POST: Gmail's unsubscribe option triggers a POST request directly, bypassing a confirmation page.
  • Testing: Thorough testing is essential, including server-side verification.
  • Compliance Check: Tools like aboutmy.email can give an indication of compliance.
  • Bulk Sender Requirements: Google and Microsoft mandates the inclusion of the List-Unsubscribe header and expect the POST method to be handled appropriately for immediate unsubscription

Key considerations

  • Request Type Handling: Ensure your server correctly differentiates and processes GET and POST requests to the unsubscribe URL.
  • User Experience (UX): While compliant, consider if using separate URLs might offer a better user experience.
  • HTTPS Compliance: Ensure the List-Unsubscribe URL is using HTTPS.

What email marketers say
8Marketer opinions

Multiple sources confirm that using the same URL for both the List-Unsubscribe header and the body link is compliant with RFC 8058 for one-click unsubscribe, provided that the server correctly differentiates between GET and POST requests. Specifically, POST requests to the header URL should trigger a silent unsubscribe, while GET requests to the body link should lead to an unsubscribe confirmation page. Some sources suggest that using different URLs might offer a better user experience.

Key opinions

  • RFC 8058 Compliance: Using the same URL is compliant with RFC 8058 as long as GET and POST requests are handled differently.
  • Silent Unsubscribe: POST requests to the List-Unsubscribe header URL must result in a silent unsubscribe.
  • Confirmation Page: GET requests to the unsubscribe link in the email body should direct to a confirmation page.
  • Improved Deliverability: Correct implementation of one-click unsubscribe improves email deliverability.

Key considerations

  • Request Handling: Ensure your server can differentiate and correctly handle GET and POST requests to the unsubscribe URL.
  • User Experience: Consider whether using different URLs for header and body links might improve the user experience.
Marketer view

Email marketer from EmailonAcid stated that the List-Unsubscribe header must have a way to unsubscribe a user with a single click. As long as it handles the requests as needed, it can be the same URL as the body link.

December 2022 - EmailonAcid
Marketer view

Email marketer from Mailjet explains that using the List-Unsubscribe header with a one-click unsubscribe option is crucial for compliance. They highlight the importance of handling POST requests correctly to ensure a seamless unsubscribe experience. They also mention that the URL used in the header can technically be the same as the one in the email body, as long as the server differentiates between GET and POST requests.

November 2023 - Mailjet
Marketer view

Email marketer from StackOverflow writes that he believes it to be okay to use the same URL for both, they reiterate that the different request types from the header versus the body must be respected.

January 2025 - StackOverflow
Marketer view

Email marketer from Email Geeks shares that if the engineer receives a HTTPS POST request on the unsubscribe URL, they must silently unsubscribe the user. If they get an HTTPS GET Request, they must return HTML which allows the user to click.

May 2022 - Email Geeks
Marketer view

Email marketer from Email Marketing Forum stated that technically yes it is fine to have the same URL as long as they are handled differently. But also notes that different URL's would lead to a better UX.

August 2022 - Email Marketing Forum
Marketer view

Email marketer from Reddit shares that it is compliant, as long as you handle the HTTPS POST request for the header link correctly versus the HTTPS GET request from the body link.

September 2024 - Reddit
Marketer view

Email marketer from Litmus explains that implementing a one-click unsubscribe, using the List-Unsubscribe header correctly, improves deliverability. The article indicates it's acceptable for the header URL to direct to the same unsubscribe page as the body link, provided the server handles POST requests from the header differently from GET requests from the body link.

March 2025 - Litmus
Marketer view

Email marketer from Sendinblue shares that RFC 8058 compliance requires a one-click unsubscribe mechanism. The List-Unsubscribe header should be implemented correctly, and while the URL can be the same as in the email body, it’s vital to process POST requests silently to unsubscribe the user without requiring additional clicks.

December 2021 - Sendinblue

What the experts say
5Expert opinions

Experts indicate that using the same URL for both the List-Unsubscribe header and the email body is acceptable. The key is proper handling of the request type; the header requires a POST request that results in immediate unsubscription, while the body link should lead to a confirmation page. Testing the implementation, especially server-side, is crucial. Compliance can be initially gauged by tools like aboutmy.email. Gmail's unsubscribe feature bypasses the subscription center, directly POSTing to the server.

Key opinions

  • URL Reuse: It is acceptable to use the same URL for both the List-Unsubscribe header and the email body.
  • POST vs. GET: The server must differentiate between POST requests from the header (silent unsubscribe) and GET requests from the body (confirmation page).
  • Gmail Behavior: Gmail's unsubscribe option sends a POST request directly, bypassing the subscription center.
  • Testing Importance: Thorough testing of the unsubscribe functionality is essential.
  • Initial Compliance Check: Tools like aboutmy.email can provide an initial indication of compliance.

Key considerations

  • Server-Side Implementation: Ensure the server correctly handles POST requests for immediate unsubscription from the List-Unsubscribe header.
  • Testing Process: Implement a robust testing process, including command-line testing, to verify one-click unsubscribe functionality.
  • HTTPS: Ensure that the List-Unsubscribe URL is HTTPS.
Expert view

Expert from Email Geeks explains that using the same URL for both List-Unsubscribe header and the body is normal. The header requires a List-Unsubscribe-Post header and a POST request to the URL must perform the unsubscription. When clicked from the body the URL must go to a webpage to unsubscribe.

September 2024 - Email Geeks
Expert view

Expert from Email Geeks advises to personally test the one-click unsubscribe functionality rather than trusting the server-side implementation.

January 2022 - Email Geeks
Expert view

Expert from Word to the Wise explains that a one-click unsubscribe can be tested using a command line to POST to the unsubscribe URL.

April 2021 - Word to the Wise
Expert view

Expert from Email Geeks explains that the Gmail unsubscribe option will not open a subscription center, but will silently POST to the server and unsubscribe the user.

December 2024 - Email Geeks
Expert view

Expert from Word to the Wise shares that if aboutmy.email reports the email as compliant, it is likely compliant. He then reiterates that the List-Unsubscribe needs to be an HTTPS one-click unsubscribe.

February 2022 - Word to the Wise

What the documentation says
4Technical articles

Documentation from RFC 8058, Google, Microsoft, and SparkPost collectively indicates that using the same URL in both the List-Unsubscribe header and the email body is permissible. RFC 8058 itself doesn't prohibit it, and Google and Microsoft emphasize the need for a one-click unsubscribe mechanism implemented through the List-Unsubscribe header, requiring correct handling of POST requests. SparkPost explicitly states the URLs can be the same, stressing the importance of differentiating between GET and POST requests on the server.

Key findings

  • RFC 8058 Allowance: RFC 8058 does not explicitly forbid using the same URL in the List-Unsubscribe header and the email body.
  • One-Click Mandate: Google and Microsoft require a one-click unsubscribe feature via the List-Unsubscribe header.
  • POST Request Handling: Correct handling of POST requests to the List-Unsubscribe header URL is crucial for compliance.
  • GET/POST Differentiation: The server must differentiate between GET requests (e.g., from the body link) and POST requests (from the header).

Key considerations

  • Server Configuration: Proper server configuration is essential to differentiate and correctly process GET and POST requests to the unsubscribe URL.
  • Bulk Sender Guidelines: Adhere to bulk sender guidelines from providers like Google and Microsoft to ensure deliverability and compliance.
Technical article

Documentation from SparkPost explains that the URL in the List-Unsubscribe header can be the same. They do emphasize that if this is the case then the server must differentiate between GET and POST requests.

February 2025 - SparkPost
Technical article

Documentation from Microsoft details the requirements for bulk email senders, including the need for a one-click unsubscribe option. It mandates the inclusion of the List-Unsubscribe header, and while it doesn't explicitly prohibit the same URL, it expects the POST method to be handled appropriately for immediate unsubscription.

December 2022 - Microsoft
Technical article

Documentation from Google Workspace Admin Help explains that Gmail requires a one-click unsubscribe feature, implemented via the List-Unsubscribe header. While not directly addressing the same URL, the documentation emphasizes the importance of handling POST requests correctly to facilitate one-click unsubscription, implying that the header URL is treated differently.

February 2023 - Google Workspace Admin Help
Technical article

Documentation from RFC Editor specifies that the List-Unsubscribe header field can contain either a single URI or a comma-separated list of URIs. These URIs provide a means for users to unsubscribe from the mailing list. The standard doesn't explicitly forbid the same URL being used in both header and body but mandates specific behavior for POST requests to the header URL.

June 2022 - RFC Editor