Unsubscribe link injected automatically
Why it matters
Manual unsubscribe link inclusion means that any template published without that link violates CAN-SPAM and GDPR Article 21 simultaneously. In 2024, Gmail and Yahoo added a hard requirement for List-Unsubscribe-Post headers on all bulk sends — without it, messages are increasingly routed to spam or rejected outright. Relying on individual template authors to remember the link is the systematic failure mode: teams under deadline drop it, new contributors don't know the requirement exists, and automated campaign cloning propagates the omission silently.
Severity rationale
High because missing unsubscribe mechanisms violate CAN-SPAM and GDPR requirements, and the absence of `List-Unsubscribe-Post` headers causes Gmail bulk sends to be filtered or rejected.
Remediation
Inject the unsubscribe footer HTML and both required headers automatically in the ESP adapter layer, keyed on message.emailType, in lib/email/providers/sendgrid.ts:
const isMarketing = message.emailType === 'marketing'
const unsubUrl = isMarketing
? `${process.env.APP_URL}/unsubscribe?token=${message.unsubscribeToken}`
: undefined
await sgMail.send({
...basePayload,
html: isMarketing
? message.html + `<p style="font-size:12px"><a href="${unsubUrl}">Unsubscribe</a></p>`
: message.html,
headers: isMarketing ? {
'List-Unsubscribe': `<${unsubUrl}>`,
'List-Unsubscribe-Post': 'List-Unsubscribe=One-Click'
} : {}
})
Transactional emails must be explicitly typed so they are not injected; the adapter, not the template author, owns this responsibility.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Sending Pipeline & Infrastructure Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- gdpr · Art. 21 — Right to Object (unsubscribe from direct marketing)
- external · can-spam-act — CAN-SPAM Act — Section 5(a)(3) opt-out mechanism
- external · gmail-yahoo-bulk-sender-2024-unsubscribe — Google/Yahoo One-Click Unsubscribe Requirement (2024) — RFC 8058
Taxons
History
- 2026-04-18·v1.0.0·Initial import from sending-pipeline-infrastructure·automated