How Unsubscribe Works
Understand the token-based one-click unsubscribe flow
How Unsubscribe Works
Mailnaptic provides a secure, standards-compliant unsubscribe system that protects both your contacts and your sender reputation. Every email sent through Mailnaptic includes an unsubscribe mechanism, and understanding how it works helps you maintain trust with your audience and comply with email regulations.
One-Click Unsubscribe (RFC 8058)
Mailnaptic implements the List-Unsubscribe and List-Unsubscribe-Post email headers as specified in RFC 8058. These headers allow email clients like Gmail, Yahoo, and Apple Mail to display a native "Unsubscribe" button directly in their interface. When a contact clicks this button, the email client sends a POST request to Mailnaptic, and the contact is immediately unsubscribed — no extra page visit required.
This is critical for maintaining a good sender reputation, because major mailbox providers now require RFC 8058 support for bulk senders.
Token-Based Security
Every unsubscribe link contains a cryptographic token generated using HMAC-SHA256. This token encodes the contact's identity and is signed with your organization's unsubscribe secret key. When someone clicks an unsubscribe link, Mailnaptic verifies the token signature before processing the request.
This approach prevents several attack vectors:
- URL guessing: Tokens are cryptographically random and cannot be predicted.
- Tampering: Any modification to the URL invalidates the HMAC signature.
- Replay attacks: Tokens are tied to the specific contact and campaign combination.
The Unsubscribe Flow
- Contact clicks the unsubscribe link in an email or uses the native one-click button.
- Mailnaptic validates the HMAC token to confirm the request is legitimate.
- If valid, the contact is shown the preference center where they can choose to unsubscribe from specific topics or from all emails entirely.
- If the contact chooses to unsubscribe from all, they can optionally provide a reason.
- Mailnaptic updates the contact's status to unsubscribed and records the timestamp, source (link vs. one-click header), and any reason provided.
- Future campaign sends automatically exclude contacts with an unsubscribed status.
Footer Links
Every email sent through Mailnaptic automatically includes an unsubscribe link in the footer. This link is personalized per recipient and contains the HMAC token. You can customize the text of the link in your email template, but the link itself is always generated by Mailnaptic to ensure proper token inclusion.
Resubscription
Contacts who have unsubscribed can resubscribe if they visit your preference center and opt back in, or if they submit a new signup form. Mailnaptic records the resubscription event with a fresh consent timestamp. You cannot manually resubscribe a contact — they must take an explicit action to opt back in.
Compliance
Mailnaptic's unsubscribe system complies with CAN-SPAM, GDPR, and CASL requirements. Unsubscribe requests are processed immediately, and contacts are suppressed from all future sends within seconds of opting out.