Why RFC 8058 compliance is non-negotiable in 2026
Under sender requirements enforced by Gmail, Yahoo, and Apple Mail, messages sent without valid RFC 8058 headers risk immediate spam folder placement or domain throttling.
RFC 8058 requires two specific MIME headers in the email envelope and an HTTPS POST endpoint capable of processing the unsubscribe request without user interaction.
Required Email Headers
When sending notifications or digests via SadaSend, supply the required headers in the API payload:
{
"to": "alex@customer.com",
"subject": "Weekly AI Digest #42",
"headers": {
"List-Unsubscribe": "<https://www.sadasend.com/api/unsubscribe?token=jwt_token_here>, <mailto:unsubscribe@sadasend.com?subject=unsubscribe_jwt_token_here>",
"List-Unsubscribe-Post": "List-Unsubscribe=One-Click"
}
}Next.js 15 RFC 8058 Unsubscribe Endpoint (app/api/unsubscribe/route.ts)
Googlebot and Yahoo mail servers will issue an HTTP POST request with a form-encoded payload containing List-Unsubscribe=One-Click. Your endpoint must accept POST and return 200 OK.
import { NextRequest, NextResponse } from 'next/server';
export async function POST(req: NextRequest) {
const token = req.nextUrl.searchParams.get('token');
const bodyText = await req.text();
// Validate RFC 8058 body parameter
if (!bodyText.includes('List-Unsubscribe=One-Click')) {
return NextResponse.json({ error: 'Invalid RFC 8058 request body' }, { status: 400 });
}
// Update customer preference in database without requiring login
console.log(`[RFC_8058] Unsubscribing token: ${token}`);
// await db.users.update({ where: { token }, data: { unsubscribed: true } });
return new NextResponse('Unsubscribed successfully', { status: 200 });
}Building AI agents that send email?
Scoped API keys, per-key recipient allowlists, approval mode and a hosted MCP server with ten tools — on the free plan, without a card.