When unsubscribe is safe
Mail from a real business you recognize, a store you bought from or a service you signed up for, is the safe case. In the United States the CAN-SPAM Act requires commercial senders to offer a way to opt out and to honor the request within 10 business days, according to the Federal Trade Commission's compliance guide. Since February 2024, Google and Yahoo have also required bulk senders to support one-click unsubscribe, the method described in RFC 8058, and to honor those requests within two days. A real company has every reason to stop.
The safest way to unsubscribe from that kind of sender is the unsubscribe button your mail app shows near the top of the message, not a link at the bottom. That button reads the List-Unsubscribe header the sender put on the message, and with the one-click method your provider sends the request for you, so you do not open the sender's web page at all.
When unsubscribe is a trap
Spam is a different animal. A spammer sends to millions of guessed or bought addresses and has no idea which ones are real. A click on their unsubscribe link answers that question for them: the address is live, and a person opens the mail. A confirmed address is worth more on the lists they trade, so the result can be more spam from senders you have never heard of. Some links go further and open a page that tries to get a password or install something.
The Federal Trade Commission's advice on phishing is to ask one question before you click a link in an email: do I have an account with this company? If the answer is no, it could be a phishing scam, and the FTC says to report the message and delete it. For mail that looks like spam, marking it as spam does that and helps your provider learn.
The home page has a picture of the two paths side by side: we do not unsubscribe from just anyone.
How to tell the difference
- Do you recognize the company? If you have never bought from it or signed up, treat it as spam.
- Does the sender's address match the name? A message that says it is from your bank but comes from a random domain is not from your bank.
- Did the mail authenticate? Most mail apps can show the message details. A real company's mail passes the checks called SPF, DKIM and DMARC.
- Does the text read like a real business? Strange symbols in the subject, lots of misspellings, urgent threats and shortened links are all bad signs.
- Has it been quiet for a long time? A sender that has not written in a year does not need an unsubscribe. Replying only tells it you are still there.
How Mail Housekeeper decides for you
Doing those five checks by hand for a few hundred senders is the part nobody has time for, so the housekeeper runs a checker on every sender in the Unsubscribe pile before the review page is ready. A sender is verified only when its domain is a live business, its mail authenticated and came from where it says, its name fits its address, nothing looks like phishing, a sample of its text reads like normal mail, and it has a real unsubscribe header.
- Unsubscribes go only through the mail header, the same one-click method the big providers use. No link inside a message is ever opened.
- A sender that fails any check is moved only: its mail goes to the holding folder and nothing is sent back.
- A sender silent for 365 days is never unsubscribed, whatever the checker says.
- No sender is unsubscribed twice. One that keeps writing after the request is held on every later pass instead.
An honest word: no tool stops spam completely, and some will always find you. What the checker does is make sure cleaning your inbox never invites more of it. Everything the checker verifies is on the how it works page.