You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Add RFC 8058 one-click unsubscribe headers to all marketing sends #23
Gmail and Yahoo expect bulk senders to support one-click unsubscribe.
Campaign and sequence sends (e.g. automation/process-ongoing-sequence.ts) call sendMail without List-Unsubscribe headers, as far as a code search shows. Only the transactional path forwards caller-supplied headers. Please verify no ESP layer adds them, then:
Set List-Unsubscribe (mailto and https) and List-Unsubscribe-Post: List-Unsubscribe=One-Click on every broadcast and sequence email.
Sign the unsubscribe URL per contact and team, and handle the POST without a confirmation page.
Add tests for the headers and the one-click endpoint.
The token never expires (CAN-SPAM requires at least 30 days). Mailcheap signs it with an HMAC key derived per purpose (HKDF), so an unsubscribe token can never be used as a tracking or confirm token.
Activity
clbotdev commentedon Oct 10, 2026
Notes from the follow-up review of https://github.com/marclou/mailcheap (
lib/unsubscribe.js,app/api/unsubscribe/route.js):sendMailsets only what the caller passes, and only the transactional path forwards headers.GET /unsubscribe/:tokenunsubscribes as soon as it's fetched, so link scanners unsubscribe real readers. The one-click POST from this issue and the GET → confirmation page fix should land together.