The unsubscribe link in real spam is not a way out. It is a signal that tells the sender your address is live and read by a person. I run AliasFleet, an email-alias service that gives each site its own forwarding address, so mail can be traced back to where it came from. The safe move depends on who sent the mail, and spam senders honour nothing.
Two kinds of unwanted mail
Unwanted mail splits into two buckets, and each one wants the opposite response.
Bucket one is mail from a list you joined. A newsletter you signed up for. A shop you bought from. An account you made. You know the sender, you remember signing up, and you just want the mail to stop. Unsubscribe is the right tool for that mail.
Bucket two is mail from senders you never dealt with. A prize you never entered. A lookalike invoice for an order you never placed. A crypto pitch from a stranger. A message from a company you never heard of saying you were added to their list. You were never subscribed, so there is nothing to unsubscribe from. Clicking the link in that mail does not remove you. It tells the sender you exist.
Ask Leo states it as a flat rule: unsubscribe from mail you asked for, never click unsubscribe in mail you did not ask for, and mark that mail as spam instead. The rule holds up. Blocking helps less than people expect, because the From address in spam is often forged and changes from one send to the next. The report button trains the filter.
The click that tells a spammer you are real
A body unsubscribe link in spam usually carries a per-recipient token in the URL. Click it, and your browser sends a GET request to the sender's server. The server logs that your address clicked. That part is not theory. It is how web servers work, and whoever runs the server can see it directly.
Security writers warn that the click marks your address as live, monitored, and read by a real person, and that such addresses attract more mail and sharper targeting. The logging mechanism behind that warning is real. Nobody has published a controlled measurement of how much extra spam one click buys you. Treat it as a strong warning, not a measured number.
The sharper risk is the page itself. Solomon ITC's write-up of the unsubscribe trap describes lookalike pages that ask you to log in, "confirm" your email, or enter a password to finish unsubscribing. A real unsubscribe never needs your password or your personal details. A page that asks for them is not an unsubscribe page. It is a credential harvest dressed as one.
Malware from a bare click sits in a different category. One click on a link rarely infects a patched modern browser on its own. Solomon ITC calls drive-by downloads from such links rare but serious. The common harm is confirmation plus the lookalike page, not infection. That is still enough reason not to click.
As CyberPeace's analysis of weaponised unsubscribe links puts it, the trap works because unsubscribing feels like the responsible thing to do.
Kill the address instead of asking the sender
Here is where the alias changes the whole problem. Give every site its own forwarding address, and mail from that site arrives on one address and one address only. When that address starts getting spam, you do not have to persuade the sender of anything. Pause the alias or kill it, and the mail stops, because the address it was sent to no longer forwards anywhere.
Unsubscribe is a negotiation. It asks a stranger to stop, and it works only when the stranger follows rules. Killing the alias is not a request. It works whether the sender honours anything or not. An email alias set up per site also tells you where the mail came from: a message on the alias you gave to one shop came from that shop, or from whoever that shop handed it to. That is the leak-tracing mechanism doing its job.
One cost, stated plainly. Killing an alias also kills wanted mail on it, like receipts and password resets from that site. Move the accounts you still need to a fresh alias first, then kill the old one.
The button in your mail app is a different tool
Most people think there is one unsubscribe link. There are two, and they work in different ways.
The first is the link in the body of the message, usually in the footer. The sender wrote it. Clicking it opens the sender's site in your browser. You are now on their ground, in their flow, and anything that page asks for is a request you have to judge on the spot.
The second is the button your mail app puts near the sender's name. Gmail shows Unsubscribe next to the sender. Outlook offers it in its Subscriptions page. That button does not open the sender's site. It runs on headers in the message, and the mechanism is defined in RFC 8058, published in January 2017.
It works like this. A sender that supports one-click adds two headers to the message. List-Unsubscribe holds an HTTPS address. List-Unsubscribe-Post reads List-Unsubscribe=One-Click. When you press the mail app's button, your mail provider sends a POST request to that address with List-Unsubscribe=One-Click in the body, and the sender is meant to remove you. No page opens. No login is asked for. No cookies travel with it. The message must carry a valid DKIM signature covering both headers, or the receiver should not offer one-click at all. The sender must not answer the POST with a redirect.
Google's sender guidelines require this of bulk senders: anyone sending more than 5,000 messages a day to personal Gmail accounts must make marketing and subscribed messages support one-click unsubscribe, and must also include a clearly visible unsubscribe link in the message body. The header route and the body link are both required. Valimail's explainer walks through the same split.
The mail-app button still tells the sender you clicked. That is its job: the POST goes to the sender's endpoint and carries the token that identifies your subscription. What the button buys you is narrower. It keeps you out of the sender's browser flow. No landing page, no login prompt, no password field, no survey. For mail you signed up for, that is the safest way to leave. For mail from an unknown sender, even the button is the wrong move, because the POST itself confirms engagement. Report it instead.
What the law makes real senders do
Real senders operate under rules that spammers ignore. Knowing the rules makes the test easy.
Under the CAN-SPAM Act, every commercial message must include a clear way to opt out. The FTC's compliance guide says the opt-out mechanism must keep working for at least 30 days after the message is sent, and the sender must honour the request within 10 business days. The sender cannot charge a fee, cannot ask for personal details beyond an email address, and cannot demand more than a reply to the message or a visit to a single web page. Each violating email can draw a penalty of up to $53,088.
Gmail adds its own layer for bulk senders, as above: one-click support plus a visible body link. ContactRoll's write-up of the Gmail and Yahoo requirements adds the timing detail: Gmail expects the unsubscribe to be honoured within 48 hours, faster than the law's 10 business days.
Transactional mail sits outside all of this. Receipts and password resets do not need an unsubscribe link, because there is no list to leave. A missing footer link is not by itself proof of spam.
The middle case: a real company you never signed up with
Not every unwanted message is spam from a criminal. Some of it comes from real companies whose lists you never joined. Your address got there through a bought list, a partner promotion, or a checkbox you never saw. The mail looks professional. The branding is right. The unsubscribe link probably works.
If you have no account and no relationship with the company, treat it as spam and report it. A working unsubscribe link does not prove a real signup.
If you do have an account but never opted into marketing, skip the body link anyway. Use the mail app's button, or type the company's address into your browser yourself and change preferences inside your account. Never type a password into a page you reached from an email link.
What to do with the mail in front of you
The steps depend on which bucket the mail falls into.
For mail you signed up for, use the mail app's control. In Gmail, use Unsubscribe next to the sender's name, or go to More, then Manage subscriptions, which lists your senders and lets you leave each one. Gmail notes it can take a few days for the mail to stop. In Outlook, go to Settings, then Mail, then Subscriptions. Our Gmail spam guide walks through the Gmail side in more detail.
For mail you never signed up for, report it. In Gmail, use Report spam. In Outlook, use Junk. Then delete it. Do not click anything in it, including the unsubscribe link. If the same sender keeps writing on an alias you control, kill that alias and the channel dies with it. The general stop-spam guide covers the wider cleanup, and the piece on why spam keeps rising explains where the mail comes from.
If you already clicked and typed nothing on the page, there is little to do beyond watching your inbox. If you typed a password, change it on the real site, reached by typing the address yourself, and change it anywhere else you used the same one. Check Have I Been Pwned to see whether your address has turned up in a known breach, and think about whether the alias that got the mail is one you still need.
Unsubscribe is a tool for lists you joined. For everything else, the report button and a dead alias do more than any click in a spammer's footer.
Top comments (0)