Does the DKIM domain need to align with the List-Unsubscribe domain?
Updated on 11 Oct 2026: We clarified RFC 8058's domain rule and updated the provider requirements and testing steps.
No. The DKIM signing domain in d= does not need to match the domain in the List-Unsubscribe URL or mailto address. RFC 8058 requires a valid DKIM signature that covers List-Unsubscribe and List-Unsubscribe-Post. It does not require the signing domain to match the unsubscribe endpoint.
A brand domain can sign a message whose unsubscribe URL uses a list-management host, provided the signature validates after delivery and the signed header list includes both unsubscribe headers. The URL host controls where the POST request goes. It does not control which DKIM d= domain is allowed.
- RFC 8058 requires a valid DKIM signature that covers both unsubscribe headers, not a domain match between d= and the URL host.
- Gmail requires RFC 8058 one-click unsubscribe for marketing and subscribed messages sent by bulk senders, defined as roughly 5,000 or more messages to personal Gmail accounts within 24 hours.
- Yahoo requires a functioning List-Unsubscribe header for bulk marketing and subscribed mail. Its sender rules recommend the RFC 8058 POST method and also accept mailto.
- DMARC checks alignment between the visible From domain and SPF or DKIM, not between DKIM and the unsubscribe endpoint.
- Testing must use the delivered raw message because changes to signed header values can break DKIM.
What RFC 8058 actually checks
RFC 8058 defines a safe one-click unsubscribe method that mailbox providers can offer inside the inbox. A sender includes one List-Unsubscribe header with an HTTPS URI and one List-Unsubscribe-Post header containing List-Unsubscribe=One-Click. The message also needs a valid DKIM signature that covers both header fields. A mailto address can accompany the HTTPS URI, but mailto alone is not RFC 8058 one-click unsubscribe.
The standard does not require the DKIM d= value to match the HTTPS host in the unsubscribe URL. The signature proves that a signer protected the unsubscribe instructions against changes in transit.
Compliant header pattern
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=brand.example; s=smtpapi; h=from:to:subject:list-unsubscribe-post:list-unsubscribe; bh=...; b=... List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: <https://lists.vendor.example/u/abc123>
The DKIM examples are abbreviated. The sending system must generate real body hashes and signatures for each message; the placeholder values are not usable signatures.
In that example, lists.vendor.example does not need to be brand.example. The receiver validates the signature from d=brand.example and checks that both unsubscribe header names are included in h=.
Separate the checks
Check DKIM coverage, DMARC alignment, and opt-out handling separately. The unsubscribe URL host belongs to the opt-out check and has no DMARC alignment role.
- The h= list must include both unsubscribe header names.
- At least one DKIM signature covering both headers must validate in the delivered message.
- The HTTPS URI must identify the recipient and list. Use an opaque, hard-to-forge token and validate it at the endpoint.
- The endpoint must accept an unauthenticated one-click POST and must not return an HTTPS redirect.
Why some older guidance requires matching domains
The July 2016 Internet-Draft required domain alignment between the unsubscribe URL domain and the DKIM signing domain in section 6. That document was a proposal, not the published standard.
The final RFC 8058 does not contain that condition. It requires a valid DKIM signature covering both unsubscribe headers. Advice that repeats the draft's URL domain condition is outdated; audit against the final RFC and current mailbox-provider requirements.
Why the URL domain can differ
Many senders use one system for brand identity and another for unsubscribe processing. A retail brand, for example, can send from news@brand.example while its list platform hosts the one-click URL on a different domain. That setup is common and is not automatically non-compliant.
DKIM signs message content and headers. The DKIM domain identifies the signer and points receivers to the public key. The List-Unsubscribe URL identifies where the receiver sends the unsubscribe POST. These parts do different jobs.
What must match
- For DMARC to pass, SPF or DKIM must pass with identifier alignment to the visible From domain. This compares the SPF-authenticated MAIL FROM domain or a valid DKIM d= domain. Relaxed alignment compares organizational domains, while strict alignment requires an exact domain match.
- The selector and d= domain must locate the public key that verifies the DKIM signature.
- Bulk sender checks evaluate authentication, complaint rate, and unsubscribe support as separate requirements.
What can differ
- The unsubscribe URL can use a vendor or list-management host.
- The exact URL subdomain does not need to appear in the DKIM d= value.
- A vendor DKIM signature can coexist with a brand DKIM signature.
If DKIM itself fails, run the selector and domain through the DKIM checker and confirm that the delivered message still has a valid signature. A correct DNS key proves only part of the setup.
How to check DKIM header coverage
The h= tag does not merely announce that certain headers exist. In a valid DKIM signature, the listed header instances are part of the signed input after DKIM canonicalization. If a covered header's canonicalized value changes between signing and verification, DKIM fails. The DKIM canonicalization rules allow some whitespace and folding changes when relaxed header canonicalization is used.
This matters for unsubscribe handling because some platforms add, rewrite, or normalize headers late in the outbound path. An unsubscribe URL added after signing is not covered. If the URL is covered and then rewritten, the signature no longer verifies.
|
|
|
|---|---|---|
d= | Signing domain | Key lookup and signature verify |
s= | Selector | Public key exists in DNS |
h= | Signed headers | Includes both unsubscribe headers |
bh= | Body hash | Canonicalized body hash matches |
b= | Signature | Signature verifies with the public key |
Key DKIM fields to inspect in delivered source
A common broken pattern has working unsubscribe headers and a valid DKIM signature that did not sign those headers.
Broken header pattern
DKIM-Signature: v=1; a=rsa-sha256; d=brand.example; s=smtpapi; h=from:to:subject:mime-version; bh=...; b=... List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: <https://lists.vendor.example/u/abc123>
That message can pass ordinary DKIM for the headers it signed, but it does not meet the RFC 8058 one-click condition because the unsubscribe headers are outside the signed header list. RFC 8058 requires both header names in the h= tag of a valid signature.
Gmail and Yahoo bulk sender requirements
For bulk marketing and subscribed messages, treat authentication, complaint rate, and unsubscribe support as separate provider checks. Gmail's sender guidelines require RFC 8058 HTTPS one-click unsubscribe. Yahoo requires a functioning List-Unsubscribe header for bulk senders, recommends the RFC 8058 POST method, and accepts mailto. A mailto-only header follows RFC 2369 but does not meet Gmail's one-click requirement.
Google counts messages across the same primary domain, including subdomains, and keeps bulk sender status once a sender reaches its roughly 5,000-message threshold. Yahoo's FAQ does not publish a numeric bulk sender threshold. Both providers exclude transactional messages, such as password resets, from the one-click marketing requirement.
Both providers require covered senders to honor unsubscribe requests within 48 hours. That timing rule is separate from DKIM signature coverage and separate again from DMARC alignment.
Both providers also require a clearly visible unsubscribe link in the message body. That link can open a preference page, but it does not replace the required unsubscribe header mechanism.
A message can therefore pass DMARC but fail RFC 8058 because the unsubscribe headers are not signed. It can also satisfy RFC 8058 header coverage but fail broader sender requirements because DMARC fails or the endpoint does not process the request.
Flowchart showing DKIM signing, signed unsubscribe headers, receiver validation, and one-click POST handling.
Correct headers do not guarantee that an inbox unsubscribe button appears. Google's eligibility checks also evaluate sender compliance. Yahoo requires sufficient reputation and engagement. A missing button alone does not prove that the DKIM and unsubscribe domains need to match.
Do not rely on a vendor signature alone when the brand's signing layer can cover the unsubscribe headers too. This is an operational preference, not an RFC requirement. It makes ownership and troubleshooting clearer when a message has multiple signatures.
Use the RFC rule, then simplify ownership
RFC 8058 does not require the DKIM d= domain to match the unsubscribe host. A brand-controlled unsubscribe subdomain is still useful when practical because it makes ownership clear and keeps audits easier to explain.
How to test DKIM and one-click unsubscribe
Test a real message through the same production path that a subscriber receives, then inspect the delivered source. An ESP configuration screen does not expose final-hop changes that break DKIM.
- Send a real campaign sample through the production path to seed inboxes, using a recipient created for unsubscribe testing.
- Confirm both unsubscribe headers are present after all platform processing.
- Match a DKIM pass result in the receiver-added Authentication-Results header to a DKIM signature using its domain and selector, then confirm that signature's h= includes both list-unsubscribe and list-unsubscribe-post.
- Before testing POST, confirm that fetching the URL with GET does not automatically unsubscribe the test recipient; security scanners fetch links without subscriber consent.
- Send an HTTPS POST with the form body List-Unsubscribe=One-Click without cookies or HTTP authentication. Confirm there is no redirect and the intended recipient is removed without a login, confirmation step, or preference-page detour.
- Confirm the recipient is suppressed from the associated list within 48 hours.
One-click HTTP POST request
POST /u/abc123 HTTP/1.1 Host: lists.vendor.example Content-Type: application/x-www-form-urlencoded Content-Length: 26 List-Unsubscribe=One-Click
The example uses application/x-www-form-urlencoded. RFC 8058 also supports multipart/form-data. Encode recipient and list details in the URL, since one-click requests do not provide extra POST fields.
A DNS-only check does not prove one-click compliance because the decisive evidence is in the delivered message and the endpoint response. DNS checks still catch missing keys, bad selectors, and DMARC policy gaps before a header review.
Email tester
Send a real email to this address. Suped shows a results button when the test is ready.
?/43tests passed
For a broader authentication pass, the domain health checker checks the domain setup that DKIM, SPF, and DMARC depend on before the message-level test.
Suped's DMARC and email authentication platform groups aggregate report results by sender so teams can investigate SPF or DKIM failures and track fixes. DMARC aggregate reports do not prove that both unsubscribe headers were signed or that an unsubscribe POST completed; keep those checks in the delivered-message and endpoint tests.
Issue steps to fix dialog showing the issue overview, tailored fix steps, and verification action
DKIM and List-Unsubscribe configuration examples
A straightforward configuration uses a From-domain DKIM signature that covers the unsubscribe headers, even when the unsubscribe URL points elsewhere. The brand's DKIM signature protects the list headers and the unsubscribe service processes the request.
Preferred setup
From: Brand <news@brand.example> DKIM-Signature: v=1; a=rsa-sha256; d=brand.example; s=news; h=from:to:subject:list-unsubscribe-post:list-unsubscribe; bh=...; b=... List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: <https://unsubscribe.brand.example/u/abc123>
A separate vendor signature can also cover the unsubscribe headers, with DMARC passing through SPF or another DKIM signature with From-domain alignment. This meets RFC 8058 when the vendor signature validates and covers both headers. Having the brand signature cover the same headers still makes ownership easier to trace when the sender controls the signing layer.
Multiple-signature setup
From: Brand <news@brand.example> DKIM-Signature: v=1; a=rsa-sha256; d=brand.example; s=news; h=from:to:subject; bh=...; b=... DKIM-Signature: v=1; a=rsa-sha256; d=vendor.example; s=mail; h=from:to:subject:list-unsubscribe-post:list-unsubscribe; bh=...; b=... List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: <https://lists.vendor.example/u/abc123>
The second example shows why the direct answer is no. The unsubscribe URL host and the DKIM signing domain differ, yet a valid DKIM signature still covers both unsubscribe headers. The overall message must also satisfy DMARC and applicable mailbox-provider requirements. Bulk sender rules still require both SPF and DKIM authentication, even though one passing mechanism with identifier alignment is enough for DMARC. Yahoo's FAQ also warns that a DMARC pass is not guaranteed when multiple signatures with From-domain alignment include failures; verify each production signature.
Common DKIM and one-click unsubscribe failures
Most failures are not caused by an unsubscribe URL on a different domain. Missing header coverage, post-signing rewrites, a broken POST endpoint, and an authentication path that fails DMARC are the usual causes.
|
|
|
|---|---|---|
Missing header | One-click header requirement fails | Add both list headers |
Unsigned header | DKIM passes, RFC check fails | Include headers in h= |
Late rewrite | DKIM fails after delivery | Sign after final edit |
Broken POST | Header exists, unsubscribe fails | Accept POST and remove recipient |
DMARC fail | Authentication requirement fails | Fix SPF or DKIM alignment |
Troubleshooting patterns for one-click unsubscribe and DKIM
A branded unsubscribe host remains a sound operational choice. It gives security teams, mailbox providers, and recipients a clearer signal that the link belongs to the sender. A message is not non-compliant solely because the URL host differs from the DKIM d= value.
Views from the trenches
Best practices
Check delivered raw message headers because ESP previews show headers before final signing.
Have the same brand DKIM signature cover unsubscribe headers when your stack allows it.
Use opaque tokens in unsubscribe URLs so one-click POSTs remove only the intended user.
Common pitfalls
Assuming h= only lists names, then changing signed unsubscribe headers after signing later.
Testing DNS only, without inspecting the delivered message after every outbound hop in the path.
Treating a mailto header as the same thing as RFC 8058 HTTPS one-click unsubscribe.
Expert tips
Keep List-Unsubscribe-Post next to List-Unsubscribe in signing config and code reviews.
Track each sender separately because one platform can sign correctly while another fails.
Prefer a branded unsubscribe subdomain, but do not block launch solely for that reason.
Marketer view
Marketer from Email Geeks says the DKIM d= domain does not need to match the List-Unsubscribe URL domain if the required headers are signed.
2024-06-03 - Email Geeks
Marketer view
Marketer from Email Geeks says both List-Unsubscribe headers need DKIM coverage for one-click handling to pass the practical check.
2024-06-03 - Email Geeks
