When clicking unsubscribe is safe — and when it isn't

By MercPrivacy · Published 2026-08-01 · Updated 2026-08-05

The never-click-unsubscribe rule is half right. Two checks — do you know the sender, and does the mail authenticate — sort the legally binding links from the bait in about thirty seconds.

Somewhere along the way you were told never to click unsubscribe. The advice usually arrives with a knowing tone: clicking tells them you are real, and the spam gets worse. Like most folk wisdom, it is half right, and the half that is wrong is costing you a cleaner inbox.

Unsubscribe links come in two populations. One is a legal obligation that real companies take seriously, because ignoring it invites regulators. The other is bait dressed up as a courtesy. The entire skill is telling the two apart, and it takes about thirty seconds once you know what to look for.

Here is the sorting logic we use, and why it works.

## The two questions that decide it

Before you touch any link in a commercial email, ask two things. They are independent, and you need both answers.

- **Do you know the sender?** Not "does the name look familiar" — did you actually do business with this company, create an account, or hand them your address on purpose? A retailer you bought from last year qualifies. A wellness newsletter you have never heard of does not. - **Does the message authenticate?** Modern email carries cryptographic evidence of who sent it. If the message passes SPF, DKIM and DMARC for the domain it claims to be from, the sender is who they say they are. If it fails, the From line is a costume. We walk through the mechanics in [SPF, DKIM and DMARC in plain English](https://mercprivacy.com/knowledge/spf-dkim-dmarc-plain-english).

Known sender plus passing authentication: unsubscribe freely. Unknown sender or failed authentication: do not touch anything in the message. Everything else in this article is detail on those two rules.

## Why unsubscribe works on real companies

For a legitimate business, your unsubscribe click is not a suggestion. Federal law requires commercial email to carry a working opt-out, and requires the sender to honor it within ten business days. Real companies comply — not because they love you, but because the FTC can seek penalties that run past $50,000 per violating email, and because mailbox providers punish sloppy senders by routing their mail straight to spam.

So when the sender is a real company, clicking unsubscribe is both safe and legally meaningful. You have made a request the law obligates them to honor. If the mail keeps coming past the ten-business-day window, that is no longer marketing. That is a violation, and it belongs in your records.

One caveat worth knowing: ordinary recipients cannot sue under the federal spam statute itself — enforcement belongs to the FTC, state attorneys general and mailbox providers. We wrote about [why you cannot sue over spam email](https://mercprivacy.com/knowledge/why-you-cannot-sue-over-spam-email), and about the state laws that pick up where it stops.

> An unsubscribe link is a binding promise from a real company — and a tripwire from a fake one.

## Why the same click is dangerous from a stranger

A spammer's unsubscribe link does three possible jobs, none of them for you.

- **Confirmation** — the click proves a live human reads that address. Confirmed-live addresses are worth more when the list is resold, so your polite opt-out becomes a quality stamp on the product being sold. - **Redirection** — the link can route through tracking domains, or land on a page that asks you to "verify" your address or log in to manage preferences. Now it is phishing with better manners. - **Nothing at all** — plenty of these links are decorative. The sender was never going to keep a suppression list; the link exists to make the mail look lawful at a glance.

A sender who forged their own headers is not going to honor your preferences. Asking a liar to stop lying, through the liar's own link, is not a strategy.

## The thirty-second check

You do not need to read raw headers every time. In most mail clients the signals sit near the surface.

1. **Look at the actual sending domain**, not the display name. A household brand mailing from a string of random words dot something has answered your question already. 2. **Check the authentication verdict.** Gmail's Show original screen states the SPF, DKIM and DMARC results in a plain table at the top. Other clients bury it a little deeper — our guide to [finding the raw headers](https://mercprivacy.com/knowledge/how-to-find-email-headers) shows the path in Gmail, Outlook and Apple Mail. 3. **Ask what relationship this reflects.** If you cannot name one, there is nothing to unsubscribe from. Filter it, block the sender, and move on.

If a message fails the check, mark it as spam rather than deleting it outright — the report trains your provider's filtering. And if the same operation keeps arriving, keep a copy. Failed authentication plus a forged From line is exactly the kind of falsity that several state email laws let recipients act on, which makes a preserved specimen worth more than a deleted one.

## What to do instead of clicking

For mail that flunks the check, work from outside the message.

- **Use your mail client's block and filter tools.** They act on the sender and the pattern, not on the message's own links, so there is nothing for a scammer to exploit. - **Report, then archive one copy.** Marking as spam helps everyone downstream. For repeat offenders, a folder of preserved originals is the raw material of a pattern. - **Slow the supply.** Spam volume tracks how widely your address circulates. Using distinct addresses for signups and trimming your data-broker footprint shrinks the pipeline — that is the [privacy side of our practice](https://mercprivacy.com/privacy).

## If your inbox is the battlefield

Sorting authenticated marketing from forged junk is the kind of thing we do all day. [Stephanie](https://mercprivacy.com/stephanie) can look at what you are receiving and tell you instantly, free, whether it is filter-and-forget material or something with legal weight — and [how it works](https://mercprivacy.com/how-it-works) covers what happens from there. We are not a law firm; when a matter requires legal representation, a licensed attorney is engaged.