Email unsubscribe

What this feature does

A signed unsubscribe URL lets a recipient stop optional marketing delivery without signing in or exposing an enumerable contact identifier.

This guide describes the behavior implemented by Mallello, the people allowed to use it, and the operational checks that keep it dependable.

Detailed workflow

1. The campaign includes a token signed with EMAIL_UNSUBSCRIBE_SECRET.
2. The recipient opens the unsubscribe page.
3. The server verifies signature, scope, and expiration rules.
4. The contact becomes unsubscribed and is excluded from future optional sends.
5. The page confirms the result even when the operation was already completed.

Rules and permissions

• Unsubscribe is idempotent and should take effect promptly.
• Transactional messages that are strictly necessary may use a separate classification, subject to law.
• The secret is high entropy and server-only.
• Rotating it requires a transition strategy for links already sent.

Failure handling and edge cases

• Invalid or tampered tokens fail safely without revealing contact records.
• A database failure must not falsely claim success.
• Manual re-subscription requires fresh affirmative consent.