Publish headers that match your unsubscribe endpoint
Use a secure HTTPS unsubscribe URL and implement the expected one-click POST behavior for clients that support it. Validate the request, apply the suppression update, and return an appropriate response without requiring a login or extra confirmation step.
Do not use a URL that performs an unsubscribe merely when fetched by a scanner or preview generator. Separate safe link inspection from the explicit unsubscribe action so automated link checks do not opt recipients out accidentally.
Test and honor the request promptly
Send test messages to clients that expose unsubscribe controls and verify both the header and visible body link. Confirm that requests update the correct address and message category, and that duplicate requests remain safe.
Keep the suppression mechanism consistent across all sending paths. Monitor failures without logging sensitive tokens, and provide a working alternative in the message body if the client does not support the header.