Every commercial email includes one-click unsubscribe in header and body

CAN-SPAM §5, GDPR Art. 21, and Gmail/Yahoo's 2024 bulk sender requirements all mandate a working one-click unsubscribe path — RFC 8058 specifically requires both the List-Unsubscribe and List-Unsubscribe-Post headers plus a POST endpoint. Missing either header or burying the body link in illegible gray text is a direct regulatory violation that exposes the business to FTC enforcement action and causes Gmail to route bulk sends to spam, tanking deliverability for every user on the list. The business impact compounds: a single CAN-SPAM complaint can trigger an FTC investigation; a spam classification tanks open rates across the entire subscriber base.

Add List-Unsubscribe and List-Unsubscribe-Post headers to every commercial email send call, and implement both GET and POST endpoints at /api/unsubscribe.

// lib/email.ts — add unsubscribe headers to every marketing send
export async function sendMarketingEmail({ to, subject, html, unsubscribeToken }: {
  to: string; subject: string; html: string; unsubscribeToken: string
}) {
  const unsubUrl = `https://example.com/api/unsubscribe?token=${unsubscribeToken}`
  return resend.emails.send({
    from: 'Your Product <hello@example.com>',
    to, subject, html,
    headers: {
      'List-Unsubscribe': `<${unsubUrl}>`,
      'List-Unsubscribe-Post': 'List-Unsubscribe=One-Click',
    },
  })
}

The POST handler (RFC 8058 one-click) must suppress without requiring login. Store the unsubscribe token on the subscriber record, not the campaign.