missing List-Unsubscribe now gets bulk mail rejected outright

"""Check a rendered message for RFC 8058 one-click unsubscribe compliance.

Since November 2025 Gmail and Yahoo reject non-compliant bulk mail with a permanent
550 rather than deferring it. Having the header is not enough: it needs an HTTPS
URL, and it needs the separate List-Unsubscribe-Post header to count as one-click.
"""
import argparse
import re
import sys
from email import policy
from email.parser import BytesParser

ONE_CLICK = "List-Unsubscribe=One-Click"


def check(headers, is_transactional=False):
    """Pure decision function over a mapping of headers.

    Returns a list of problems. Transactional mail is checked in reverse: it should
    NOT carry these headers, because inviting someone to unsubscribe from a password
    reset is its own kind of failure.
    """
    lu = headers.get("List-Unsubscribe", "") or ""
    lup = (headers.get("List-Unsubscribe-Post", "") or "").strip()

    if is_transactional:
        return ([] if not lu else
                ["transactional mail carries List-Unsubscribe; one-click is for "
                 "marketing and promotional mail only"])

    problems = []
    if not lu:
        problems.append("no List-Unsubscribe header")
    else:
        urls = re.findall(r"<([^>]+)>", lu)
        if not urls:
            problems.append("List-Unsubscribe has no value in angle brackets")
        elif not any(u.lower().startswith("https://") for u in urls):
            problems.append("List-Unsubscribe has no HTTPS URL; a mailto: alone is "
                            "not one-click")
    if not lup:
        problems.append("no List-Unsubscribe-Post header; without it the link is not "
                        "treated as one-click")
    elif lup != ONE_CLICK:
        problems.append(f"List-Unsubscribe-Post is {lup!r}, must be exactly {ONE_CLICK!r}")
    return problems


def main():
    ap = argparse.ArgumentParser()
    ap.add_argument("message", nargs="?", help="raw .eml file; defaults to stdin")
    ap.add_argument("--transactional", action="store_true")
    args = ap.parse_args()

    raw = open(args.message, "rb").read() if args.message else sys.stdin.buffer.read()
    msg = BytesParser(policy=policy.default).parsebytes(raw)

    problems = check(msg, args.transactional)
    for p in problems:
        print(f"FAIL {p}", file=sys.stderr)
    if not problems:
        print("OK   one-click unsubscribe headers are compliant")
    return 1 if problems else 0


if __name__ == "__main__":
    sys.exit(main())

/**
 * Check a rendered message for RFC 8058 one-click unsubscribe compliance.
 *
 * Since November 2025 Gmail and Yahoo reject non-compliant bulk mail with a
 * permanent 550 rather than deferring it. Having the header is not enough.
 */
import { readFile } from 'node:fs/promises';

const ONE_CLICK = 'List-Unsubscribe=One-Click';

/**
 * Pure decision function over a mapping of headers.
 *
 * Transactional mail is checked in reverse: it should NOT carry these headers,
 * because inviting someone to unsubscribe from a password reset is its own failure.
 */
export function check(headers, isTransactional = false) {
  const get = (k) => headers[k] ?? headers[k.toLowerCase()] ?? '';
  const lu = get('List-Unsubscribe');
  const lup = get('List-Unsubscribe-Post').trim();

  if (isTransactional) {
    return lu ? ['transactional mail carries List-Unsubscribe; one-click is for '
      + 'marketing and promotional mail only'] : [];
  }

  const problems = [];
  if (!lu) problems.push('no List-Unsubscribe header');
  else {
    const urls = [...lu.matchAll(/<([^>]+)>/g)].map((m) => m[1]);
    if (!urls.length) problems.push('List-Unsubscribe has no value in angle brackets');
    else if (!urls.some((u) => u.toLowerCase().startsWith('https://'))) {
      problems.push('List-Unsubscribe has no HTTPS URL; a mailto: alone is not one-click');
    }
  }
  if (!lup) {
    problems.push('no List-Unsubscribe-Post header; without it the link is not treated as one-click');
  } else if (lup !== ONE_CLICK) {
    problems.push(`List-Unsubscribe-Post is "${lup}", must be exactly "${ONE_CLICK}"`);
  }
  return problems;
}

function parseHeaders(raw) {
  const head = raw.split(/\r?\n\r?\n/)[0];
  const out = {};
  for (const line of head.split(/\r?\n(?![ \t])/)) {
    const i = line.indexOf(':');
    if (i > 0) out[line.slice(0, i).trim()] = line.slice(i + 1).trim().replace(/\r?\n[ \t]+/g, ' ');
  }
  return out;
}

async function main() {
  const file = process.argv.slice(2).find((a) => !a.startsWith('--'));
  const raw = await readFile(file, 'utf8');
  const problems = check(parseHeaders(raw), process.argv.includes('--transactional'));
  problems.forEach((p) => console.error(`FAIL ${p}`));
  if (!problems.length) console.log('OK   one-click unsubscribe headers are compliant');
  process.exit(problems.length ? 1 : 0);
}

if (import.meta.url === `file://${process.argv[1]}`) main();

from check_list_unsubscribe import check

GOOD = {
    "List-Unsubscribe": "<https://example.com/u/abc>, <mailto:u@example.com>",
    "List-Unsubscribe-Post": "List-Unsubscribe=One-Click",
}


def test_compliant_message_passes():
    assert check(GOOD) == []


def test_mailto_alone_is_not_one_click():
    headers = GOOD | {"List-Unsubscribe": "<mailto:u@example.com>"}
    assert any("HTTPS" in p for p in check(headers))


def test_missing_post_header_fails():
    headers = {"List-Unsubscribe": GOOD["List-Unsubscribe"]}
    assert any("List-Unsubscribe-Post" in p for p in check(headers))


def test_post_header_with_wrong_text_fails():
    """Right idea, wrong string. Receivers compare exactly."""
    headers = GOOD | {"List-Unsubscribe-Post": "One-Click"}
    assert any("must be exactly" in p for p in check(headers))


def test_transactional_mail_should_not_carry_it():
    assert check(GOOD, is_transactional=True)


def test_transactional_without_the_header_is_fine():
    assert check({}, is_transactional=True) == []

import { test } from 'node:test';
import assert from 'node:assert/strict';
import { check } from './check-list-unsubscribe.mjs';

const GOOD = {
  'List-Unsubscribe': '<https://example.com/u/abc>, <mailto:u@example.com>',
  'List-Unsubscribe-Post': 'List-Unsubscribe=One-Click',
};

test('a compliant message passes', () => {
  assert.deepEqual(check(GOOD), []);
});

test('mailto alone is not one-click', () => {
  const h = { ...GOOD, 'List-Unsubscribe': '<mailto:u@example.com>' };
  assert.ok(check(h).some((p) => p.includes('HTTPS')));
});

test('a missing Post header fails', () => {
  const h = { 'List-Unsubscribe': GOOD['List-Unsubscribe'] };
  assert.ok(check(h).some((p) => p.includes('List-Unsubscribe-Post')));
});

test('a Post header with the wrong text fails', () => {
  const h = { ...GOOD, 'List-Unsubscribe-Post': 'One-Click' };
  assert.ok(check(h).some((p) => p.includes('must be exactly')));
});

test('transactional mail should not carry it', () => {
  assert.ok(check(GOOD, true).length);
});