Check DKIM coverage before offering one-click
03DomainKeys Identified Mail (DKIM) authenticates signed message content. At least one valid signature must cover both unsubscribe fields and list them in its h= tag.
In this separate example, the only valid signature covers Subject but not either unsubscribe field. The required signature is absent, so the shown receiver follows SHOULD NOT and withholds the offer.
Source for this drawing: RFC 8058 · Read RFC section 4 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
A signature label is not a successful authentication check.
- Senders MUST apply at least one valid DKIM signature. Both List-Unsubscribe and List-Unsubscribe-Post MUST be covered and included in the h= tag of a valid DKIM-Signature field.
- If the required signature is absent, the receiver SHOULD NOT offer a one-click unsubscribe for that message. This recommendation is distinct from the consent MUST NOT rule.
- A valid signature covering other fields alone does not satisfy this requirement. Valid DKIM also does not prove user consent, benign content or the identity of whoever later possesses the unsubscribe URI.
These are independent authentication comparisons. The diagram abbreviates a DKIM signature to its relevant h= names and a stated verifier result; it is not a complete signature or a cryptographic verification implementation. One eligible signature suffices; the RFC does not require every signature to qualify or require From-domain alignment here.
Read the RFC section ↗