Does the DKIM domain need to align with the List-Unsubscribe domain?
Updated on 5 Aug 2026: We updated this guide with current Gmail and Yahoo unsubscribe requirements and clearer RFC 8058 endpoint checks.
No. The DKIM signing domain in d= does not need to match the domain in the List-Unsubscribe URL or mailto address. RFC 8058 requires a valid DKIM signature that covers List-Unsubscribe and List-Unsubscribe-Post. It does not require the signing domain to match the unsubscribe endpoint.
A brand domain can sign a message whose unsubscribe URL uses a list-management host, provided the signature validates after delivery and the signed header list includes both unsubscribe headers. The URL host controls where the POST request goes. It does not control which DKIM d= domain is allowed.
- RFC 8058 requires a valid DKIM signature that covers both unsubscribe headers, not a domain match between d= and the URL host.
- Gmail requires RFC 8058 one-click unsubscribe for marketing and subscribed messages sent by senders exceeding 5,000 messages a day to personal Gmail accounts.
- Yahoo requires a functioning List-Unsubscribe header for bulk marketing and subscribed mail. Its sender rules recommend the RFC 8058 POST method and also accept mailto.
- DMARC checks alignment between the visible From domain and SPF or DKIM, not between DKIM and the unsubscribe endpoint.
- Testing must use the delivered raw message because header changes after signing break DKIM.
What RFC 8058 actually checks
RFC 8058 defines a safe one-click unsubscribe method that mailbox providers can offer inside the inbox. A sender includes one List-Unsubscribe header with an HTTPS URI and one List-Unsubscribe-Post header containing List-Unsubscribe=One-Click. The message also needs a valid DKIM signature that covers both header fields.
The standard does not require the DKIM d= value to match the HTTPS host in the unsubscribe URL. The signature proves that a signer protected the unsubscribe instructions against changes in transit.
Compliant header pattern
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=brand.example; s=smtpapi; h=from:to:subject:list-unsubscribe-post:list-unsubscribe; bh=...; b=... List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: <https://lists.vendor.example/u/abc123>
In that example, lists.vendor.example does not need to be brand.example. The receiver validates the signature from d=brand.example and checks that both unsubscribe header names are included in h=.
Separate the checks
Check DKIM coverage, DMARC alignment, and opt-out handling separately. The unsubscribe URL host belongs to the opt-out check and has no DMARC alignment role.
- The h= list must include both unsubscribe header names.
- The delivered message must retain a valid DKIM signature after every outbound hop.
- The HTTPS URI must identify the recipient and list, preferably with an opaque, hard-to-forge token.
- The endpoint must accept an unauthenticated one-click POST and must not return an HTTPS redirect.
Why the URL domain can differ
Many senders use one system for brand identity and another for unsubscribe processing. A retail brand, for example, can send from news@brand.example while its list platform hosts the one-click URL on a different domain. That setup is common and is not automatically non-compliant.
DKIM signs message content and headers. The DKIM domain identifies the signer and points receivers to the public key. The List-Unsubscribe URL identifies where the receiver sends the unsubscribe POST. These parts do different jobs.
What must match
- For DMARC, the visible From domain must align with either the SPF-authenticated domain or a valid DKIM d= domain. Relaxed alignment compares organizational domains, while strict alignment requires an exact domain match.
- The selector and d= domain must locate the public key that verifies the DKIM signature.
- Bulk sender checks evaluate authentication, complaint rate, and unsubscribe support as separate requirements.
What can differ
- The unsubscribe URL can use a vendor or list-management host.
- The exact URL subdomain does not need to appear in the DKIM d= value.
- A vendor DKIM signature can coexist with a brand DKIM signature.
If DKIM itself fails, run the selector and domain through the DKIM checker and confirm that the delivered message still has a valid signature. A correct DNS key proves only part of the setup.
Header signing details that cause confusion
The h= tag does not merely announce that certain headers exist. In a valid DKIM signature, the listed header instances are part of the signed input after DKIM canonicalization. If a covered header changes between signing and verification, DKIM fails.
This matters for unsubscribe handling because some platforms add, rewrite, or normalize headers late in the outbound path. An unsubscribe URL added after signing is not covered. If the URL is covered and then rewritten, the signature no longer verifies.
|
|
|
|---|---|---|
d= | Signing domain | Key lookup and signature verify |
s= | Selector | Public key exists in DNS |
h= | Signed headers | Includes both unsubscribe headers |
bh= | Body hash | Body content still matches |
b= | Signature | Signed input is unchanged |
Key DKIM fields to inspect in delivered source
A common broken pattern has working unsubscribe headers and a valid DKIM signature that did not sign those headers.
Broken header pattern
DKIM-Signature: v=1; d=brand.example; s=smtpapi; h=from:to:subject:mime-version; bh=...; b=... List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: <https://lists.vendor.example/u/abc123>
That message can pass ordinary DKIM for the headers it signed, but it does not meet the RFC 8058 one-click condition because the unsubscribe headers are outside the signed header list. Al Iverson's List-Unsub-Post guidance makes the same operational point: inspect the delivered DKIM h= field.
How Gmail and Yahoo fit in
For bulk marketing and subscribed messages, treat authentication, complaint rate, and unsubscribe support as separate provider checks. Gmail requires RFC 8058 one-click unsubscribe when a sender exceeds 5,000 messages a day to personal Gmail accounts. Yahoo requires a functioning List-Unsubscribe header for bulk senders, recommends the RFC 8058 POST method, and accepts mailto.
Both providers require covered senders to honor unsubscribe requests within 48 hours. That timing rule is separate from DKIM signature coverage and separate again from DMARC alignment.
A message can therefore pass DMARC but fail RFC 8058 because the unsubscribe headers are not signed. It can also satisfy RFC 8058 header coverage but fail broader sender requirements because DMARC fails or the endpoint does not process the request.
Flowchart showing DKIM signing, signed unsubscribe headers, receiver validation, and one-click POST handling.
Do not rely on a vendor signature alone when the brand's signing layer can cover the unsubscribe headers too. This is an operational preference, not an RFC requirement. It makes ownership and troubleshooting clearer when a message has multiple signatures.
Use the RFC rule, then simplify ownership
RFC 8058 does not require the DKIM d= domain to match the unsubscribe host. A brand-controlled unsubscribe subdomain is still useful when practical because it makes ownership clear and keeps audits easier to explain.
A practical testing workflow
Test a real message through the same production path that a subscriber receives, then inspect the delivered source. An ESP configuration screen does not expose final-hop changes that break DKIM.
- Send a real campaign sample to seed inboxes and test addresses.
- Confirm both unsubscribe headers are present after all platform processing.
- Confirm list-unsubscribe and list-unsubscribe-post appear in the h= tag of a valid DKIM signature.
- Confirm at least one DKIM signature covering both headers validates in the delivered message.
- Send the one-click form POST without cookies or HTTP authentication, then confirm the endpoint returns no redirect and removes the intended recipient without a login or preference-page detour.
- Confirm the recipient is suppressed from the associated list within 48 hours.
A DNS-only check does not prove one-click compliance because the decisive evidence is in the delivered message and the endpoint response. DNS checks still catch missing keys, bad selectors, and DMARC policy gaps before a header review.
Email tester
Send a real email to this address. Suped shows a results button when the test is ready.
?/43tests passed
For a broader authentication pass, the domain health checker checks the domain setup that DKIM, SPF, and DMARC depend on before the message-level test.
Suped's product fits here when the workflow needs ongoing monitoring rather than a one-time check. Suped groups DMARC aggregate reporting with SPF and DKIM monitoring and real-time alerts, so teams can trace a failing sender and record the fix without manually interpreting aggregate XML.
Issue steps to fix dialog showing the issue overview, tailored fix steps, and verification action
Configuration examples
The cleanest configuration uses a From-domain DKIM signature that covers the unsubscribe headers, even when the unsubscribe URL points elsewhere. The brand's DKIM signature protects the list headers and the unsubscribe service processes the request.
Preferred setup
From: Brand <news@brand.example> DKIM-Signature: v=1; d=brand.example; s=news; h=from:to:subject:list-unsubscribe-post:list-unsubscribe; bh=...; b=... List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: <https://unsubscribe.brand.example/u/abc123>
A separate vendor signature can also cover the unsubscribe headers, with DMARC passing through SPF or another DKIM signature aligned to the From domain. This setup is acceptable when the delivered message proves it. Having the brand signature cover the same headers still makes ownership easier to trace when the sender controls the signing layer.
Multiple-signature setup
From: Brand <news@brand.example> DKIM-Signature: v=1; d=brand.example; s=news; h=from:to:subject; bh=...; b=... DKIM-Signature: v=1; d=vendor.example; s=mail; h=from:to:subject:list-unsubscribe-post:list-unsubscribe; bh=...; b=... List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: <https://lists.vendor.example/u/abc123>
The second example shows why the direct answer is no. The unsubscribe URL host and the DKIM signing domain differ, yet a valid DKIM signature still covers both unsubscribe headers. The overall message must also satisfy DMARC and applicable mailbox-provider requirements.
Common failure modes
Most failures are not caused by an unsubscribe URL on a different domain. Missing header coverage, post-signing rewrites, a broken POST endpoint, and an authentication path that fails DMARC are the usual causes.
|
|
|
|---|---|---|
Missing header | No one-click option | Add both list headers |
Unsigned header | DKIM passes, RFC check fails | Include headers in h= |
Late rewrite | DKIM fails after delivery | Sign after final edit |
Broken POST | Header exists, unsubscribe fails | Accept POST and remove recipient |
DMARC fail | Authentication requirement fails | Fix SPF or DKIM alignment |
Troubleshooting patterns for one-click unsubscribe and DKIM
A branded unsubscribe host remains a sound operational choice. It gives security teams, mailbox providers, and recipients a clearer signal that the link belongs to the sender. A message is not non-compliant solely because the URL host differs from the DKIM d= value.
Views from the trenches
Best practices
Check delivered raw message headers because ESP previews show headers before final signing.
Have the same brand DKIM signature cover unsubscribe headers when your stack allows it.
Use opaque tokens in unsubscribe URLs so one-click POSTs remove only the intended user.
Common pitfalls
Assuming h= only lists names, then changing signed unsubscribe headers after signing later.
Testing DNS only, without inspecting the delivered message after every outbound hop in the path.
Treating a mailto header as the same thing as RFC 8058 HTTPS one-click unsubscribe.
Expert tips
Keep List-Unsubscribe-Post next to List-Unsubscribe in signing config and code reviews.
Track each sender separately because one platform can sign correctly while another fails.
Prefer a branded unsubscribe subdomain, but do not block launch solely for that reason.
Marketer from Email Geeks says the DKIM d= domain does not need to match the List-Unsubscribe URL domain if the required headers are signed.
2024-06-03 - Email Geeks
Marketer from Email Geeks says both List-Unsubscribe headers need DKIM coverage for one-click handling to pass the practical check.
2024-06-03 - Email Geeks
The practical answer
The shortest correct answer is no: the DKIM d= domain does not need to match the List-Unsubscribe domain. The required RFC 8058 check is whether a valid DKIM signature covers List-Unsubscribe and List-Unsubscribe-Post in the delivered message.
A clean setup uses a From-domain DKIM signature that covers the unsubscribe headers and, when practical, a branded unsubscribe subdomain. This makes the message easier to troubleshoot across sending systems. Suped's DMARC and authentication monitoring gives teams ongoing visibility into sender alignment and DKIM failures so configuration drift can be fixed before the next campaign.
