{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/require-the-https-post-contract-before-offering-one-click-unsubscribe/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/require-the-https-post-contract-before-offering-one-click-unsubscribe/",
        "slug": "require-the-https-post-contract-before-offering-one-click-unsubscribe",
        "url": "https://update.dsesecurity.com/updates/require-the-https-post-contract-before-offering-one-click-unsubscribe/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/require-the-https-post-contract-before-offering-one-click-unsubscribe.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/require-the-https-post-contract-before-offering-one-click-unsubscribe/"
        },
        "title": "Require the HTTPS POST contract before offering one-click unsubscribe",
        "summary": "Use RFC 8058 — Signaling One-Click Functionality for List Email Headers to review this narrow operational decision without extending the source beyond its stated scope.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "advisory",
            "name": "Advisory"
        },
        "featured": false,
        "image": {
            "theme": "network-infrastructure",
            "label": "Networks & infrastructure",
            "alt": "Resilient network core with engineered blue and gold data paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "networks-infrastructure",
                "name": "Networks & Infrastructure",
                "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-08-27T12:16:52+00:00",
        "modified_at": "2026-08-27T12:36:16+00:00",
        "reviewed_on": "2026-08-26",
        "reading_minutes": 3,
        "word_count": 575,
        "potentially_affected": "Teams, systems, services, or facilities within the stated scope of RFC 8058 — Signaling One-Click Functionality for List Email Headers",
        "dse_recommendation": "Compare the observed state with the cited official source, document applicability and exceptions, and test any approved change with rollback safeguards.",
        "primary_source": {
            "name": "RFC 8058 — Signaling One-Click Functionality for List Email Headers",
            "url": "https://www.rfc-editor.org/rfc/rfc8058.html",
            "published_on": null,
            "authority": "www.rfc-editor.org"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>Use this document to connect an official requirement or behavior to observable evidence: Require the HTTPS POST contract before offering one-click unsubscribe. Only the official source and traced locations below supply facts. Confirm applicability before acting.</p>\n<h2>Source fact:</h2>\n<p>The official <a href=\"https://www.rfc-editor.org/rfc/rfc8058.html\" target=\"_blank\" rel=\"noopener noreferrer\">RFC 8058 — Signaling One-Click Functionality for List Email Headers</a> from RFC Editor / Internet Engineering Task Force supports the following bounded statements:</p>\n<ul>\n<li>One-click unsubscribe requires one List-Unsubscribe header containing an HTTPS URI and one List-Unsubscribe-Post header whose value is List-Unsubscribe=One-Click. The research record locates this support at <strong>Section 3.1 (Mail Senders)</strong>.</li>\n<li>The unsubscribe request is an unauthenticated-context POST: it carries no cookies or HTTP authorization, and the server must not redirect it. The research record locates this support at <strong>Section 3.1 (Mail Senders), POST handling</strong>.</li>\n<li>A receiver should offer one-click only when a valid DKIM signature covers both unsubscribe header fields. The research record locates this support at <strong>Section 4 (Additional Requirements)</strong>.</li>\n</ul>\n<p>Do not import neighboring assumptions into the source record. The supported task is a scoped comparison involving sending domains, receiving domains, message agents, headers, authentication results, policy records, and failure handling and the conditions the source actually describes.</p>\n<h2>What the source does not establish</h2>\n<p>This RFC evidence supports only the named mail-protocol decision; it does not prove provider support, deliverability, or compliance for a particular flow. The citation is not a substitute for observed state, authorization, compliance evidence, or dependency health. Examine authoritative DNS, certificates, time, gateways, identity stores, reputation services, and third-party mail providers before translating the source into an operational decision.</p>\n<h2>Applicability questions</h2>\n<ul>\n<li>For source statement 1 at <strong>Section 3.1 (Mail Senders)</strong>, which observable configuration, record, or test can confirm applicability here?</li>\n<li>For source statement 2 at <strong>Section 3.1 (Mail Senders), POST handling</strong>, which observable configuration, record, or test can confirm applicability here?</li>\n<li>For source statement 3 at <strong>Section 4 (Additional Requirements)</strong>, which observable configuration, record, or test can confirm applicability here?</li>\n<li>Within sending domains, receiving domains, message agents, headers, authentication results, policy records, and failure handling, which versions, roles, and configuration states define the review population?</li>\n<li>Could authoritative DNS, certificates, time, gateways, identity stores, reputation services, and third-party mail providers invalidate the test, hide a failure, or change applicability?</li>\n<li>Who owns the decision, and which observation requires stopping, escalation, or rollback?</li>\n</ul>\n<h2>DSE recommendation:</h2>\n<p>DSE recommends using the cited source as the evidence anchor for this decision. Use a two-person review for the source interpretation and the resulting operational decision. Record the source location, examined part of sending domains, receiving domains, message agents, headers, authentication results, policy records, and failure handling, observed and expected states, owner, and reason for deviation.</p>\n<p>For an approved change, define prerequisites, a limited test path, success and stop conditions, monitoring, and rollback. Check authoritative DNS, certificates, time, gateways, identity stores, reputation services, and third-party mail providers in design order. Protect credentials, keys, recovery material, personal data, and sensitive topology in evidence.</p>\n<h2>Verification and evidence</h2>\n<p>Tie each conclusion back to <strong>Section 3.1 (Mail Senders)</strong>; <strong>Section 3.1 (Mail Senders), POST handling</strong>; <strong>Section 4 (Additional Requirements)</strong> and to observable material such as sanitized messages, DNS records, SMTP transcripts, authentication results, policy evaluation, and delivery or rejection logs. Preserve provenance and stable identifiers without copying secrets into the evidence set.</p>\n<p>Record the decision even when no change is made, including uncertainty and the next trigger. Use safe testing conditions for disruptive work, preserve rollback proof, and revisit the conclusion after relevant platform, dependency, vendor, or ownership changes.</p>\n<h2>Official references</h2>\n<ul>\n<li><a href=\"https://www.rfc-editor.org/rfc/rfc8058.html\" target=\"_blank\" rel=\"noopener noreferrer\">RFC 8058 — Signaling One-Click Functionality for List Email Headers</a> — RFC Editor / Internet Engineering Task Force</li>\n</ul>",
        "content_text": "Use this document to connect an official requirement or behavior to observable evidence: Require the HTTPS POST contract before offering one-click unsubscribe. Only the official source and traced locations below supply facts. Confirm applicability before acting.\nSource fact:\nThe official RFC 8058 — Signaling One-Click Functionality for List Email Headers from RFC Editor / Internet Engineering Task Force supports the following bounded statements:\n\nOne-click unsubscribe requires one List-Unsubscribe header containing an HTTPS URI and one List-Unsubscribe-Post header whose value is List-Unsubscribe=One-Click. The research record locates this support at Section 3.1 (Mail Senders).\nThe unsubscribe request is an unauthenticated-context POST: it carries no cookies or HTTP authorization, and the server must not redirect it. The research record locates this support at Section 3.1 (Mail Senders), POST handling.\nA receiver should offer one-click only when a valid DKIM signature covers both unsubscribe header fields. The research record locates this support at Section 4 (Additional Requirements).\n\nDo not import neighboring assumptions into the source record. The supported task is a scoped comparison involving sending domains, receiving domains, message agents, headers, authentication results, policy records, and failure handling and the conditions the source actually describes.\nWhat the source does not establish\nThis RFC evidence supports only the named mail-protocol decision; it does not prove provider support, deliverability, or compliance for a particular flow. The citation is not a substitute for observed state, authorization, compliance evidence, or dependency health. Examine authoritative DNS, certificates, time, gateways, identity stores, reputation services, and third-party mail providers before translating the source into an operational decision.\nApplicability questions\n\nFor source statement 1 at Section 3.1 (Mail Senders), which observable configuration, record, or test can confirm applicability here?\nFor source statement 2 at Section 3.1 (Mail Senders), POST handling, which observable configuration, record, or test can confirm applicability here?\nFor source statement 3 at Section 4 (Additional Requirements), which observable configuration, record, or test can confirm applicability here?\nWithin sending domains, receiving domains, message agents, headers, authentication results, policy records, and failure handling, which versions, roles, and configuration states define the review population?\nCould authoritative DNS, certificates, time, gateways, identity stores, reputation services, and third-party mail providers invalidate the test, hide a failure, or change applicability?\nWho owns the decision, and which observation requires stopping, escalation, or rollback?\n\nDSE recommendation:\nDSE recommends using the cited source as the evidence anchor for this decision. Use a two-person review for the source interpretation and the resulting operational decision. Record the source location, examined part of sending domains, receiving domains, message agents, headers, authentication results, policy records, and failure handling, observed and expected states, owner, and reason for deviation.\nFor an approved change, define prerequisites, a limited test path, success and stop conditions, monitoring, and rollback. Check authoritative DNS, certificates, time, gateways, identity stores, reputation services, and third-party mail providers in design order. Protect credentials, keys, recovery material, personal data, and sensitive topology in evidence.\nVerification and evidence\nTie each conclusion back to Section 3.1 (Mail Senders); Section 3.1 (Mail Senders), POST handling; Section 4 (Additional Requirements) and to observable material such as sanitized messages, DNS records, SMTP transcripts, authentication results, policy evaluation, and delivery or rejection logs. Preserve provenance and stable identifiers without copying secrets into the evidence set.\nRecord the decision even when no change is made, including uncertainty and the next trigger. Use safe testing conditions for disruptive work, preserve rollback proof, and revisit the conclusion after relevant platform, dependency, vendor, or ownership changes.\nOfficial references\n\nRFC 8058 — Signaling One-Click Functionality for List Email Headers — RFC Editor / Internet Engineering Task Force",
        "content_markdown": "Use this document to connect an official requirement or behavior to observable evidence: Require the HTTPS POST contract before offering one-click unsubscribe. Only the official source and traced locations below supply facts. Confirm applicability before acting.\n\n## Source fact:\n\nThe official [RFC 8058 — Signaling One-Click Functionality for List Email Headers](https://www.rfc-editor.org/rfc/rfc8058.html) from RFC Editor / Internet Engineering Task Force supports the following bounded statements:\n\n- One-click unsubscribe requires one List-Unsubscribe header containing an HTTPS URI and one List-Unsubscribe-Post header whose value is List-Unsubscribe=One-Click. The research record locates this support at Section 3.1 (Mail Senders).\n\n- The unsubscribe request is an unauthenticated-context POST: it carries no cookies or HTTP authorization, and the server must not redirect it. The research record locates this support at Section 3.1 (Mail Senders), POST handling.\n\n- A receiver should offer one-click only when a valid DKIM signature covers both unsubscribe header fields. The research record locates this support at Section 4 (Additional Requirements).\n\nDo not import neighboring assumptions into the source record. The supported task is a scoped comparison involving sending domains, receiving domains, message agents, headers, authentication results, policy records, and failure handling and the conditions the source actually describes.\n\n## What the source does not establish\n\nThis RFC evidence supports only the named mail-protocol decision; it does not prove provider support, deliverability, or compliance for a particular flow. The citation is not a substitute for observed state, authorization, compliance evidence, or dependency health. Examine authoritative DNS, certificates, time, gateways, identity stores, reputation services, and third-party mail providers before translating the source into an operational decision.\n\n## Applicability questions\n\n- For source statement 1 at Section 3.1 (Mail Senders), which observable configuration, record, or test can confirm applicability here?\n\n- For source statement 2 at Section 3.1 (Mail Senders), POST handling, which observable configuration, record, or test can confirm applicability here?\n\n- For source statement 3 at Section 4 (Additional Requirements), which observable configuration, record, or test can confirm applicability here?\n\n- Within sending domains, receiving domains, message agents, headers, authentication results, policy records, and failure handling, which versions, roles, and configuration states define the review population?\n\n- Could authoritative DNS, certificates, time, gateways, identity stores, reputation services, and third-party mail providers invalidate the test, hide a failure, or change applicability?\n\n- Who owns the decision, and which observation requires stopping, escalation, or rollback?\n\n## DSE recommendation:\n\nDSE recommends using the cited source as the evidence anchor for this decision. Use a two-person review for the source interpretation and the resulting operational decision. Record the source location, examined part of sending domains, receiving domains, message agents, headers, authentication results, policy records, and failure handling, observed and expected states, owner, and reason for deviation.\n\nFor an approved change, define prerequisites, a limited test path, success and stop conditions, monitoring, and rollback. Check authoritative DNS, certificates, time, gateways, identity stores, reputation services, and third-party mail providers in design order. Protect credentials, keys, recovery material, personal data, and sensitive topology in evidence.\n\n## Verification and evidence\n\nTie each conclusion back to Section 3.1 (Mail Senders); Section 3.1 (Mail Senders), POST handling; Section 4 (Additional Requirements) and to observable material such as sanitized messages, DNS records, SMTP transcripts, authentication results, policy evaluation, and delivery or rejection logs. Preserve provenance and stable identifiers without copying secrets into the evidence set.\n\nRecord the decision even when no change is made, including uncertainty and the next trigger. Use safe testing conditions for disruptive work, preserve rollback proof, and revisit the conclusion after relevant platform, dependency, vendor, or ownership changes.\n\n## Official references\n\n- [RFC 8058 — Signaling One-Click Functionality for List Email Headers](https://www.rfc-editor.org/rfc/rfc8058.html) — RFC Editor / Internet Engineering Task Force"
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/require-the-https-post-contract-before-offering-one-click-unsubscribe/",
                "url": "https://update.dsesecurity.com/updates/require-the-https-post-contract-before-offering-one-click-unsubscribe/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-08-26"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/require-the-https-post-contract-before-offering-one-click-unsubscribe/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Require the HTTPS POST contract before offering one-click unsubscribe",
                        "item": "https://update.dsesecurity.com/updates/require-the-https-post-contract-before-offering-one-click-unsubscribe/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/require-the-https-post-contract-before-offering-one-click-unsubscribe/#article",
                "identifier": "https://update.dsesecurity.com/updates/require-the-https-post-contract-before-offering-one-click-unsubscribe/",
                "url": "https://update.dsesecurity.com/updates/require-the-https-post-contract-before-offering-one-click-unsubscribe/",
                "headline": "Require the HTTPS POST contract before offering one-click unsubscribe",
                "description": "Use RFC 8058 — Signaling One-Click Functionality for List Email Headers to review this narrow operational decision without extending the source beyond…",
                "abstract": "Use RFC 8058 — Signaling One-Click Functionality for List Email Headers to review this narrow operational decision without extending the source beyond its stated scope.",
                "articleBody": "Use this document to connect an official requirement or behavior to observable evidence: Require the HTTPS POST contract before offering one-click unsubscribe. Only the official source and traced locations below supply facts. Confirm applicability before acting.\nSource fact:\nThe official RFC 8058 — Signaling One-Click Functionality for List Email Headers from RFC Editor / Internet Engineering Task Force supports the following bounded statements:\n\nOne-click unsubscribe requires one List-Unsubscribe header containing an HTTPS URI and one List-Unsubscribe-Post header whose value is List-Unsubscribe=One-Click. The research record locates this support at Section 3.1 (Mail Senders).\nThe unsubscribe request is an unauthenticated-context POST: it carries no cookies or HTTP authorization, and the server must not redirect it. The research record locates this support at Section 3.1 (Mail Senders), POST handling.\nA receiver should offer one-click only when a valid DKIM signature covers both unsubscribe header fields. The research record locates this support at Section 4 (Additional Requirements).\n\nDo not import neighboring assumptions into the source record. The supported task is a scoped comparison involving sending domains, receiving domains, message agents, headers, authentication results, policy records, and failure handling and the conditions the source actually describes.\nWhat the source does not establish\nThis RFC evidence supports only the named mail-protocol decision; it does not prove provider support, deliverability, or compliance for a particular flow. The citation is not a substitute for observed state, authorization, compliance evidence, or dependency health. Examine authoritative DNS, certificates, time, gateways, identity stores, reputation services, and third-party mail providers before translating the source into an operational decision.\nApplicability questions\n\nFor source statement 1 at Section 3.1 (Mail Senders), which observable configuration, record, or test can confirm applicability here?\nFor source statement 2 at Section 3.1 (Mail Senders), POST handling, which observable configuration, record, or test can confirm applicability here?\nFor source statement 3 at Section 4 (Additional Requirements), which observable configuration, record, or test can confirm applicability here?\nWithin sending domains, receiving domains, message agents, headers, authentication results, policy records, and failure handling, which versions, roles, and configuration states define the review population?\nCould authoritative DNS, certificates, time, gateways, identity stores, reputation services, and third-party mail providers invalidate the test, hide a failure, or change applicability?\nWho owns the decision, and which observation requires stopping, escalation, or rollback?\n\nDSE recommendation:\nDSE recommends using the cited source as the evidence anchor for this decision. Use a two-person review for the source interpretation and the resulting operational decision. Record the source location, examined part of sending domains, receiving domains, message agents, headers, authentication results, policy records, and failure handling, observed and expected states, owner, and reason for deviation.\nFor an approved change, define prerequisites, a limited test path, success and stop conditions, monitoring, and rollback. Check authoritative DNS, certificates, time, gateways, identity stores, reputation services, and third-party mail providers in design order. Protect credentials, keys, recovery material, personal data, and sensitive topology in evidence.\nVerification and evidence\nTie each conclusion back to Section 3.1 (Mail Senders); Section 3.1 (Mail Senders), POST handling; Section 4 (Additional Requirements) and to observable material such as sanitized messages, DNS records, SMTP transcripts, authentication results, policy evaluation, and delivery or rejection logs. Preserve provenance and stable identifiers without copying secrets into the evidence set.\nRecord the decision even when no change is made, including uncertainty and the next trigger. Use safe testing conditions for disruptive work, preserve rollback proof, and revisit the conclusion after relevant platform, dependency, vendor, or ownership changes.\nOfficial references\n\nRFC 8058 — Signaling One-Click Functionality for List Email Headers — RFC Editor / Internet Engineering Task Force",
                "datePublished": "2026-08-27T12:16:52+00:00",
                "dateModified": "2026-08-27T12:36:16+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/require-the-https-post-contract-before-offering-one-click-unsubscribe/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/require-the-https-post-contract-before-offering-one-click-unsubscribe/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Require the HTTPS POST contract before offering one-click unsubscribe"
                },
                "articleSection": [
                    "Cybersecurity",
                    "Networks & Infrastructure"
                ],
                "keywords": [
                    "Cybersecurity",
                    "Networks & Infrastructure",
                    "Guide",
                    "Advisory priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Networks & Infrastructure",
                        "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
                    }
                ],
                "wordCount": 575,
                "timeRequired": "PT3M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "RFC 8058 — Signaling One-Click Functionality for List Email Headers",
                    "url": "https://www.rfc-editor.org/rfc/rfc8058.html"
                }
            }
        ]
    }
}