ComplianceUpdated 2026-05-25
Unsubscribe And Compliance Controls
How Mailbase signs unsubscribe links, enforces suppression states, adds List-Unsubscribe headers, and keeps marketing sends compliant.
Canonical: /docs/unsubscribe-compliance
Signed Unsubscribe Links
Mailbase generates signed unsubscribe links for campaign and API marketing sends. The signature covers workspace id, contact id, and email address, then the public endpoint verifies it before changing contact status.
GET requests redirect to the branded confirmation page. POST requests return JSON so automated one-click unsubscribe clients can complete the same action.
GET /api/unsubscribe?w=<workspace_id>&c=<contact_id>&e=<email>&sig=<hmac>
POST /api/unsubscribe?w=<workspace_id>&c=<contact_id>&e=<email>&sig=<hmac>Suppression Enforcement
- Marketing campaigns exclude contacts marked unsubscribed, bounced, complained, or suppressed.
- Transactional API sends can still reach unsubscribed contacts for service messages, but bounced, complained, and suppressed contacts remain blocked.
- Webhook events update contact status when providers report unsubscribes, bounces, or complaints.
- Admins can suppress, resubscribe, or review suppressed contacts in Settings and contact profile views with audit logging.
List-Unsubscribe Headers
For marketing sends, Mailbase adds List-Unsubscribe and List-Unsubscribe-Post headers when the provider accepts custom headers. This supports one-click unsubscribe flows in mailbox clients.
| Header | Value |
|---|---|
| List-Unsubscribe | <signed unsubscribe URL> |
| List-Unsubscribe-Post | List-Unsubscribe=One-Click |
Send-Time Validation
- Live marketing campaigns must include sender, reply-to, and compliance footer details.
- Marketing templates must provide an unsubscribe_url merge value unless the send is explicitly transactional.
- Campaigns with unfilled merge tags are blocked before launch.
- Compliance actions are recorded in audit logs without exposing email body content or secrets.