Blog

Somebody told you, years ago, never to click unsubscribe. It confirms your address is real. It tells the spammers you're alive. You've been dutifully deleting newsletters one at a time ever since, like a person bailing out a boat with a teaspoon.

That advice wasn't wrong. It was written for an inbox that doesn't exist anymore.

Here's what's actually true in 2026, and a rule simple enough to use at eight in the morning without thinking about it.

TL;DR

• In your inbox, from a sender you recognize and expected to hear from: unsubscribe. That's what the button is for and it stops the mail at the source.
• Use your mail app's own Unsubscribe button when it offers one. When the sender supports true one-click unsubscribe, your provider can process the request without you visiting the sender's page.
• In your spam folder, or from a sender you've never heard of: don't click anything. Report it and move on.
• Don't test whether a stranger's unsubscribe link is honest. Report the message instead.
• The old warning still applies to actual spam. It just stopped applying to the legitimate marketing mail that makes up most of your clutter.

Why That Advice Was Right in 2004

In 2004 your inbox was a sewer. Filtering was primitive, spam was most of what arrived, and the stuff in front of you was genuinely dangerous.

In that world, the advice made sense. Clicking an unsubscribe link in a spam message can do three things for the sender, none of them good for you. It confirms somebody reads this address. It confirms somebody reads it attentively enough to click. And it hands over a browser session to a page of his choosing.

A confirmed, attentive address can be more useful to a spam operation than an unconfirmed one. At minimum, you've told them somebody is home. That mechanism hasn't changed.

What changed is everything in front of it.

What Changed

Three things, and together they flipped the answer for most mail.

Filtering got good. The crude, dangerous spam is much less likely to reach your inbox now. A lot of it lands in spam or never arrives at all. Much of the everyday clutter left in front of you is legitimate commercial mail from real companies, including plenty you did, at some point, give your address to. Possibly while buying a lamp in 2019.

Unsubscribing became a legal requirement. In the US, the CAN-SPAM Act requires commercial mail to carry a working opt-out mechanism and to honor requests within ten business days. Europe generally goes further, requiring prior consent for direct marketing email, with an exception for some marketing to existing customers. A real company has lawyers, and those lawyers would prefer the unsubscribe link worked.

The mailbox providers made it a condition of delivery. Since 2024, Google has required senders delivering more than 5,000 messages a day to Gmail accounts to support genuine one-click unsubscribe for marketing mail and process requests within 48 hours. Yahoo requires bulk senders to provide easy unsubscribe and honor requests within two days. Microsoft now imposes stricter rules on high-volume senders too, although its unsubscribe requirement is currently framed as a best practice rather than the same mandate. At scale, making it hard to leave has become a deliverability problem, which is the only kind of problem marketing departments take seriously.

The Button vs. the Link

There are two different things people call "unsubscribe," and the difference is the most useful thing in this article.

The Unsubscribe button at the top of the message, next to the sender's name, belongs to your mail app rather than to the email. It can appear because the message carries a List-Unsubscribe header, standardized back in 1998.

What happens when you press it depends on one more header. List-Unsubscribe-Post, defined in RFC 8058, marks the address as a true one-click endpoint. When it's there and your provider supports true one-click, your provider sends the unsubscribe request itself, as a POST over HTTPS. You don't visit the sender's website, you don't load their page and you don't execute their code. The sender gets a request saying this address is out, and that's the end of it.

Why a POST rather than a normal link? Because mail security systems routinely fetch URLs automatically to check them. If simply visiting the address counted as an unsubscribe, a link scanner could remove you from a list before you'd even opened the message. The separate POST tells the sender this was an intentional unsubscribe, not a security bot kicking the tires.

Without that second header, the older List-Unsubscribe header can contain a web address or a mailto: command, and clients handle them differently. A web address may open the sender's unsubscribe page. A mailto: command can trigger an unsubscribe message to the list system, usually with some form of confirmation. Either way, it isn't the standardized hands-off HTTPS POST defined by RFC 8058.

One technical detail worth knowing. For a provider to offer true one-click, the sender's DKIM signature has to cover both unsubscribe headers, and Gmail runs its own eligibility checks before showing its control. When a provider offers true RFC 8058 one-click, that's a useful signal that the sender has implemented the required authentication and unsubscribe headers correctly. It is not proof that the sender itself is trustworthy. A dishonest operation can authenticate its domain perfectly well.

The unsubscribe link in the footer is supplied by the sender. Clicking it opens a page chosen by the sender or their mailing service, with everything that implies. For a company you recognize, fine. For anything else, you're accepting an invitation from a stranger.

There is one reason to prefer the footer link even when the safe button exists: preferences. One-click unsubscribe is deliberately blunt and applies to the list that message came from. If you want the monthly newsletter but not the daily sale email, the sender's preference page may let you turn one off without killing everything.

The Rule

Here it is, short enough to remember:

Did this arrive in my inbox, do I recognize the sender and does the message make sense?

If yes, unsubscribe. Use the app's button if there is one, the footer link if there isn't.

If no, don't click anything. Report it as spam or phishing, block the sender if you like, and leave it alone.

That's the whole decision. Everything else is detail.

One exception worth knowing: not every legitimate message has something to unsubscribe from. Receipts, password resets, security alerts and booking confirmations are transactional mail. If there's no mailing list, there may be no unsubscribe button because there shouldn't be one.

How to Tell Which One You're Looking At

If you want to be more careful than the rule, these are the signals.

You don't have to click a footer link to find out where it goes. On desktop, hover over it and look at the destination first.

Signs it's real:

• You can remember the company, or at least the purchase that got you onto the list.
• The message itself makes sense: it refers to something real, and nothing about it is urgent or odd.
• The footer link points to the company's domain or a recognizable mailing-service domain like Mailchimp or HubSpot, rather than somewhere completely unrelated.
• The unsubscribe page just says you're removed, or offers a preferences page. No login, no card details, no "confirm your identity."

Signs it isn't:

• You never had any relationship with this sender.
• The message is already in your spam folder. Your provider has told you what it thinks. Listen.
• The unsubscribe page asks for your password, your payment details or anything beyond the email address being removed.
• The link goes somewhere that has nothing to do with the sender or any mailing service.

And the one that catches people: a message that looks like a newsletter from a brand you know but arrived somewhere unexpected, or addressed to an alias you never gave that company. That's phishing wearing a marketing costume, and the unsubscribe link is the hook.

Unsubscribe or Report as Spam?

Different tools for different jobs.

Unsubscribe stops mail at the source. The sender takes you off the list and doesn't send again. Right for legitimate marketing you no longer want.

Report as spam primarily tells your provider. It trains the filtering system and, in aggregate, hurts that sender's reputation. Some providers also feed complaint information back to legitimate bulk senders. Right for mail you never asked for or don't trust.

Reporting a newsletter you genuinely subscribed to as spam is a small act of vandalism against a company whose only crime was being boring. Unsubscribe instead. Save the spam button for people who deserve it.

For a sense of scale: Google tells bulk senders to stay below a 0.1% user-reported spam rate and never hit 0.3%. Yahoo uses the same 0.3% ceiling. That's three complaints in a thousand to hit 0.3%. The spam button carries rather more weight than it looks like.

Why You Don't Unsubscribe from Actual Spam

A malicious sender has no obligation to honor the request. The link might remove you, it might confirm that somebody reads this address, or it might simply take you somewhere you shouldn't be. You have no way to tell which in advance.

That's why the old advice survives for actual spam. Don't test whether a stranger's unsubscribe system is honest. Report the message and move on.

For the longer history of how we got here, we wrote about the invention of spam and the arms race that followed.

Where [@fuck.it] Lands

Our filtering is designed to keep dangerous material out of your inbox, which is what makes the rule above workable: if something made it in front of you, the odds are already in your favor.

Our webmail shows an Unsubscribe button when the sender has implemented the necessary headers, and many modern mail clients do the same. Use it. When the sender supports proper one-click unsubscribe, the request is handled without you visiting their website. If they don't, their unsubscribe page may still open in a tab.

And if something sketchy does get through, report it rather than clicking it. That tells us something, which is more than deleting it does.

---

Sources & further reading: RFC 8058: One-Click Unsubscribe · RFC 2369: List-Unsubscribe · Google: Email sender guidelines · Google: Unsubscribe from marketing emails · Yahoo: Sender best practices · Microsoft: Outlook's requirements for high-volume senders · FTC: CAN-SPAM Act compliance guide · EU ePrivacy Directive, Article 13 · Open-Xchange: Mail security and unsubscribe

Related reads: Spam: From Canned Ham to Inbox Hell · Not Today, Scammer