DIAGNOSTIC PLAYBOOK
One-click unsubscribe endpoint: GET is not the action
The one-click mechanism uses a defined POST request rather than an ordinary link visit. Automatically unsubscribing on a GET can cause link scanners to remove subscribers unintentionally.
HealthCheck Email editorial team · · Examples are illustrative
How to investigate
- Separate the browser preference-page flow from the machine one-click POST flow.
- Test the documented POST behavior with a test subscription and confirm it does not require interactive login.
- Verify that passive link fetching does not inadvertently perform the unsubscribe action.
What this looks like
ILLUSTRATIVE EXAMPLE
A security scanner follows every link in a message. An endpoint that treats any GET as consent to unsubscribe removes recipients before they read the campaign.
A mistake to avoid
Do not use production recipients to test destructive subscription changes. Keep the endpoint behavior aligned with your sending platform's supported implementation.
Keep the result in context
Inspect the original raw message rather than a forwarded screenshot. Headers can contain private addresses, message identifiers and routing information, so redact a separate copy before sharing. Give the most weight to results added by your own trusted receiving infrastructure.
Take the next step
Use the related check to gather evidence, then compare it with the affected message or service. Keep the result and time with your notes so a later change can be distinguished from the original problem.
Sources and further reading
The protocol references below explain the underlying behavior. Your sending or DNS provider supplies the account-specific settings for its service.