Signaling One-Click Functionality for List Email Headers
This document describes a method for signaling a one-click function for the List-Unsubscribe email header field. The need for this arises out of the actuality that mail software sometimes fetches URLs in mail header fields, and thereby accidentally triggers unsubscriptions in the case of the List-Unsubscribe header field.
Normative requirements
Every sentence in this RFC carrying an RFC 2119 keyword, with the section it came from. 10 must, 5 should, 1 may.
3.1 Mail Senders
- MUSTThe List-Unsubscribe header field MUST contain one HTTPS URI.
- MAYIt MAY contain other non-HTTP/S URIs such as MAILTO:.
- MUSTThe List-Unsubscribe-Post header MUST contain the single key/value pair "List-Unsubscribe=One-Click".
- MUSTAs described below, the message MUST have a valid DomainKeys Identified Mail (DKIM) signature that covers at least the List-Unsubscribe and List-Unsubscribe-Post headers.
- MUSTThe URI in the List-Unsubscribe header MUST contain enough information to identify the mail recipient and the list from which the recipient is to be removed, so that the unsubscription process can complete automatically.
- MUST NOTThe POST request MUST NOT include cookies, HTTP authorization, or any other context information.
- SHOULDThe URI SHOULD include an opaque identifier or another hard-to-forge component in addition to, or instead of, the plaintext names of the list and the subscriber.
- SHOULDThe server handling the unsubscription SHOULD verify that the opaque or hard-to-forge component is valid.
- MUST NOTThe mail sender MUST NOT return an HTTPS redirect, since redirected POST actions have historically not worked reliably, and many browsers have turned redirected HTTP POSTs into GETs.
3.2 Mail Receivers
- SHOULDThe POST content SHOULD be sent as 'multipart/form-data' [RFC7578] or MAY be sent as 'application/x-www-form-urlencoded'.
- MUST NOTThe mail receiver MUST NOT perform a POST on the HTTPS URI without user consent.
4 Additional Requirements
- MUSTHence, senders MUST apply at least one valid DKIM signature to the message.
- MUSTThe List-Unsubscribe and List-Unsubscribe-Post headers MUST be covered by the signature and included in the "h=" tag of a valid DKIM-Signature header field.
- SHOULD NOTIf the message does not have the required DKIM signature, the mail receiver SHOULD NOT offer a one-click unsubscribe for that message.
6 Security Considerations
- SHOULDSince the mailer's server that receives the POST request cannot in general tell where the request is coming from, the URI SHOULD contain an opaque identifier or another hard-to-forge component to identify the list and recipient address.
- MUST NOTAlso, the request MUST NOT include cookies or other context information to prevent the server from associating the request with previous web requests.