Offer one-click unsubscribe

How to do it

Put exactly one HTTPS link in List-Unsubscribe (RFC 2369), optionally next to a mailto: address. Add List-Unsubscribe-Post: List-Unsubscribe=One-Click (RFC 8058). Put an opaque token in the link that names the recipient and the list. A POST to the link unsubscribes at once, with no cookies, login or redirect. A GET shows a page with a button, because mail scanners follow links on their own. List both headers in the h= tag of your DKIM signature.

Example

List-Unsubscribe: <https://news.example.com/unsubscribe?t=8f2c4a>, <mailto:unsubscribe@news.example.com?subject=8f2c4a>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

app.get('/unsubscribe', (req, res) => res.send(confirmPage(req.query.t)));
app.post('/unsubscribe', express.urlencoded({ extended: false }), async (req, res) => {
  await suppressByToken(req.query.t);
  res.status(200).send('You are unsubscribed.');
});

@app.get("/unsubscribe")
def unsubscribe_page():
    return confirm_page(request.args["t"])

@app.post("/unsubscribe")
def unsubscribe():
    suppress_by_token(request.args["t"])
    return "You are unsubscribed.", 200

How to check

Send curl -X POST -d 'List-Unsubscribe=One-Click' to the link from a test message. It answers 200 without a redirect, and the next send skips the address. A plain GET leaves the address subscribed. The DKIM-Signature header's h= lists List-Unsubscribe and List-Unsubscribe-Post.