One-Click Unsubscribe: What Gmail and Yahoo Require Since 2024

You keep reading that Gmail and Yahoo require one-click unsubscribe. Is that the unsubscribe link already sitting in your footer? Does it cover the order receipts and password resets your WordPress site sends, and does “5,000 emails a day” mean you?

Here’s what the rule says. Since February 2024, Google has required bulk senders (about 5,000 messages a day to personal Gmail accounts, by its FAQ) to support one-click unsubscribe in their marketing and subscribed messages. Yahoo asks bulk senders for it too, without naming a number.

If your site only sends things like password resets and order confirmations, you can relax about this rule: both providers exclude transactional email from it. And one-click means headers inside the email, not a link in the footer. Here’s what we’ll do: read the rule in Google’s and Yahoo’s own words, as their pages stood on October 6, 2026, then check an email your own site sent.

Table of contents

• One-click unsubscribe
• Gmail and Yahoo’s 2024 sender requirements
• The benefits of one-click unsubscribe
• One-click unsubscribe and the email WordPress sends

One-click unsubscribe

One-click unsubscribe is a pair of email headers that lets a mail app such as Gmail unsubscribe someone on the spot, by sending a request to an address you provide. A header is a line of information that travels with an email, above the part you read. The method is set out in RFC 8058, a standard published in January 2017.

Your sending tool adds the headers to each marketing email. Your reader never sees them, only the unsubscribe option their mail app shows because of them.

What makes an unsubscribe one-click?

Two headers. Google’s Email sender guidelines say: “To set up one-click unsubscribe for Gmail messages, include both of these headers in outgoing messages”. Here they are, with RFC 8058’s example address standing in for yours:

List-Unsubscribe-Post: List-Unsubscribe=One-Click
List-Unsubscribe: <https://example.com/unsubscribe/opaquepart>

When someone chooses to unsubscribe, their mail app does the rest “by performing an HTTPS POST to the HTTPS URI in the List-Unsubscribe header”, as RFC 8058 puts it. In plain words, Gmail tells your sending tool directly.

A few details decide whether it works:

• The address is https. Google’s Email sender guidelines FAQ asks for “one HTTPS URL in the List-unsubscribe: header”.
• It doesn’t redirect or open a page. RFC 8058 says “The mail sender MUST NOT return an HTTPS redirect”, and Google’s FAQ rules out links to “a landing or other type of web page”.
• The email is signed with DKIM. RFC 8058 says: “If the message does not have the required DKIM signature, the mail receiver SHOULD NOT offer a one-click unsubscribe for that message.”

Is an unsubscribe link in the footer enough?

No. Yahoo’s sender FAQ asks “Is an unsubscribe link in the body of the message sufficient?” and answers: “No, you must implement the list-unsubscribe header (preferably according to RFC 8058) in order to meet the requirement for one-click unsubscribe.” Google’s FAQ agrees: “Other types of one-click unsubscribe, such as mailto and URL unsubscribe links, don’t meet our one-click unsubscribe requirement.”

Keep the footer link, though. Google’s guidelines say marketing and subscribed messages “must support one-click unsubscribe, and include a clearly visible unsubscribe link in the message body”. Yahoo’s Sender Best Practices ask for the same.

The two providers differ on one point: mailto, which puts an email address in the header instead of a web address.

• Yahoo: “The Post (RFC 8058) method is highly recommended. The mail-to: method is acceptable.”
• Google: “We’ll continue to support mailto links but they don’t meet our one-click unsubscribe requirement.”

So go with the two headers above. Google requires them, and they’re the method Yahoo recommends.

Is one-click unsubscribe the law?

The one-click unsubscribe on this page is a Gmail and Yahoo rule, in force since 2024 and set by two mailbox providers for email sent to their users. The law has its own rules and its own deadline, so meeting one doesn’t settle the other.

In the US, that law is the CAN-SPAM Act. The FTC’s CAN-SPAM guide says: “You must honor a recipient’s opt-out request within 10 business days.” For the legal side, read our post on email legal guidelines for nonprofits.

Gmail and Yahoo’s 2024 sender requirements

Google announced the requirements in October 2023, with a statement of support from Yahoo. In Google’s words: “Starting in 2024, we’ll require bulk senders to authenticate their emails, allow for easy unsubscription and stay under a reported spam threshold”.

By now the 2024 sender requirements are just how sending to Gmail and Yahoo works. For a bulk sender, both providers’ pages ask for this:

• Authenticate your email with both SPF and DKIM, plus DMARC. (Every sender, bulk or not, needs SPF or DKIM.)
• Support one-click unsubscribe in marketing and subscribed messages.
• Keep your spam rate below 0.3%. Spam complaints get their own post: 10 ways to keep your spam complaint rate below 0.3%.

Who counts as a bulk sender?

If your domain sends nowhere near 5,000 messages a day to personal Gmail accounts, you aren’t a bulk sender by Google’s definition. And if all your site sends is email like password resets and order confirmations, the one-click rule doesn’t cover it at either provider, whatever your volume. If that’s you, one-click unsubscribe isn’t your worry, though authentication still is, and we get to it below.

Here’s the definition in Google’s FAQ: “A bulk sender is any email sender that sends close to 5,000 messages or more to personal Gmail accounts within a 24-hour period. Messages sent from the same primary domain count toward the 5,000 limit.” Before you count, know these:

• Your subdomains count together. Google’s example is a sender with 2,500 messages a day from its domain and 2,500 from a subdomain. That’s a bulk sender, “because all 5,000 messages were sent from the same primary domain”.
• Only personal Gmail accounts count. That means addresses ending in @gmail.com or @googlemail.com. Google’s FAQ says the guidelines “don’t apply to messages sent to Google Workspace accounts”.
• Bulk sender status sticks. Google: “Senders who meet the above criteria at least once are permanently considered bulk senders.”

Yahoo won’t give you a number to count against. Its FAQ says a sender “is viewed at the authenticated domain or From header domain level”, and then:

A “bulk” sender is classified as an email sender sending a significant volume of mail. We will not specify a volume threshold.

Neither Google’s page nor Yahoo’s says you become a bulk sender because the service that sends your email is a big one.

Which emails are covered?

Marketing email is covered. Transactional email (the messages a person triggers by doing something, such as resetting a password) is not. Here’s more on how transactional and marketing emails differ.

Google’s FAQ asks “Do all messages require one-click unsubscribe?” and answers:

No. One-click unsubscribe is required only for marketing and promotional messages. Transactional messages are excluded from this requirement. Some examples of transactional messages are password reset messages, reservation confirmations, and form submission confirmations.

Yahoo’s FAQ says the same: “No, one-click unsubscribe is only required for promotional/marketing messages. The requirement does not apply to transactional messages (e.g. order confirmations, password resets).”

You do the sorting, because neither provider will. Google says “Message recipients, not Google, determine the nature of the messages they receive.” Yahoo says to “rely on local regulations and your best judgment based on user behavior”.

Our opinion: if an email is there to promote something, treat it as a marketing email.

How fast do you have to honor an unsubscribe?

Plan on two days. Google’s FAQ says “we recommend that you fulfill unsubscribe requests within 48 hours”, and its enforcement table lists “Unsubscribe requests aren’t honored within 48 hours” with the result “Delivery support or mitigations unavailable”. Read that as: miss it, and Google’s delivery support is off the table.

Yahoo is blunter: “If the unsubscribe is not honored in 2 days, then it would not meet the requirement.”

Are the 2024 requirements still enforced?

Yes, and Google has turned enforcement up. Its FAQ now says:

Starting November 2025, Gmail is ramping up its enforcement on non-compliant traffic. Messages that fail to meet the email sender requirements will experience disruptions, including temporary and permanent rejections.

Don’t read that as “no headers, no delivery”, though. That passage is about the sender requirements as a whole, and on this one Google says: “We don’t automatically reject messages or mark messages as spam when they don’t meet the one-click unsubscribe requirements in our Email sender guidelines.”

We still wouldn’t skip the headers. Google also says only bulk senders that meet all the requirements, one-click unsubscribe included, are eligible for mitigation, the same word as in the 48-hour row above. Yahoo’s pages set enforcement from February 2024, and from June 2024 for one-click unsubscribe.

The benefits of one-click unsubscribe

The headers put the way out where your reader can find it. Google’s FAQ says Gmail shows its Unsubscribe link at the top of a message only when the message passes Google’s checks and has correct one-click headers.

That’s good for you as well as for them, because the other way out is a spam complaint. We’d much rather someone unsubscribe from your marketing emails than mark them as spam, since both providers ask you to keep your spam rate below 0.3%.

One-click unsubscribe and the email WordPress sends

The email WordPress sends for you is mostly the kind that the one-click unsubscribe part of the 2024 requirements leaves out. Password resets are on both providers’ lists of transactional examples, order confirmations are on Yahoo’s, and form submission confirmations are on Google’s.

WordPress itself does not add a List-Unsubscribe header to the email it sends, and neither does WooCommerce. We read the code of both in October 2026 to check. WooCommerce’s one unsubscribe feature is a link in the body of its abandoned cart recovery email.

Your marketing emails are where the rule applies

If your site also sends marketing emails (a newsletter plugin’s campaigns, a sale announcement) and your domain is a bulk sender, those are the emails that need one-click unsubscribe. Adding the headers is the job of the plugin or service that sends that email, so that’s where you check and where you fix it.

How do you check an email your site sent?

Send yourself one of your emails at a Gmail address and read its headers. Looking changes nothing, so you can’t break anything here. These are the steps from Gmail’s help page:

1. From a browser, open Gmail.
2. Open the email you want to check.
3. Next to Reply, click More, then Show original. The full header shows in a new window.

In Yahoo Mail, Yahoo’s help page says to open the email, click the More options icon, then select View Raw Message.

Now look for a line that starts List-Unsubscribe: and the line List-Unsubscribe-Post: List-Unsubscribe=One-Click. Here’s how to read what you find:

• A marketing email with both lines has the headers Google asks for, by the method Yahoo recommends.
• A marketing email with neither doesn’t meet either provider’s requirement, even with an unsubscribe link in the footer. Take it up with the tool that sends it.
• A password reset or an order confirmation with neither is fine. Transactional email is excluded.

A web host, an SMTP plugin or a sending service can add headers after WordPress hands the email over. That’s why you check a real email and don’t guess.

Your transactional email still has to be authenticated

Being excluded from one-click unsubscribe doesn’t excuse your receipts and resets from the rest. Gmail and Yahoo require every sender, bulk or not, to authenticate with SPF or DKIM. Email sent straight from a web server is often unauthenticated, blocked, or filtered to spam.

That’s the problem we built SendWP for, and it’s what we’d suggest for the email WordPress sends. SendWP is a paid service: once your site is connected, your receipts, form notifications and password resets go out through SendWP instead of your web host, with help setting up SPF and DKIM. It’s for the email WordPress sends, not for newsletters.

One thing to know before you connect it. SendWP puts an unsubscribe link in the footer of every email it sends, receipts included, and a recipient who clicks it stops receiving your site’s email. To undo that, the recipient contacts SendWP from that same email address and names your site’s domain.

Check your marketing emails for the two headers this week

You came here wondering whether one-click unsubscribe meant your footer link, your receipts, or you at all. Now you can settle it yourself. Open one of your marketing emails, look for the two header lines, and take it up with your newsletter tool if they’re missing.

Your receipts and resets don’t need those headers, but Gmail and Yahoo have expected them to be authenticated since 2024. That’s the part we’d suggest SendWP for. It’s a paid service, so see what SendWP costs.