DIAGNOSTIC PLAYBOOK
One-click unsubscribe headers need DKIM protection
RFC 8058 requires the one-click unsubscribe headers to be covered by a valid DKIM signature. Merely adding the fields does not satisfy that protection requirement.
HealthCheck Email editorial team · · Examples are illustrative
How to investigate
- Find the signature used to authenticate the message and inspect its h list.
- Confirm both List-Unsubscribe and List-Unsubscribe-Post are covered.
- Update the sending platform or signer configuration and verify a newly delivered sample.
What this looks like
ILLUSTRATIVE EXAMPLE
A custom application adds unsubscribe headers after the mail service signs. The headers are present in the received message but absent from the signed-header list.
A mistake to avoid
A passing unrelated signature is not enough to assume compliance. Check actual coverage and the applicable sender requirements.
Keep the result in context
Inspect the original raw message rather than a forwarded screenshot. Headers can contain private addresses, message identifiers and routing information, so redact a separate copy before sharing. Give the most weight to results added by your own trusted receiving infrastructure.
Take the next step
Use the related check to gather evidence, then compare it with the affected message or service. Keep the result and time with your notes so a later change can be distinguished from the original problem.
Sources and further reading
The protocol references below explain the underlying behavior. Your sending or DNS provider supplies the account-specific settings for its service.