What Is One-Click Unsubscribe?
TL;DR
One-click unsubscribe is the opt-out mechanism defined in RFC 8058, where a message carries a List-Unsubscribe header with an HTTPS URL plus a List-Unsubscribe-Post header set to List-Unsubscribe=One-Click. The receiving provider posts to that URL on request, so the recipient never sees a landing page or a preference centre.
How do you implement one-click unsubscribe?
Both headers, and a URL that can complete the job unattended. RFC 8058 requires the List-Unsubscribe field to contain an HTTPS URI, the List-Unsubscribe-Post field to contain exactly the pair List-Unsubscribe=One-Click, and the URI to carry enough information to identify the recipient and the list so removal can happen automatically.
Two details break implementations. The DKIM signature has to cover both of those headers, or a receiver cannot trust them; and the endpoint must not answer the POST with an HTTPS redirect, because redirected POST requests have historically been unreliable and some browsers convert them to GET.
Who has to support it?
Bulk senders to the large consumer providers. Google requires it for marketing and subscribed messages from senders who send 5,000 or more messages a day to Gmail accounts, asks that a clearly visible unsubscribe link also appear in the message body, and states that unsubscribe requests be processed within two days. Transactional mail is out of scope.
For business outreach below that volume it is not a requirement, and it is still the right default. The header costs a form endpoint and removes the main reason a recipient reaches for the spam button instead.
Frequently asked questions
No, and asking for a confirmation defeats it. The provider posts to the URL and expects the removal to happen, so an endpoint that responds with a form or a login is not one-click regardless of what the headers claim.