Where
Settings→Email Compliance
Your role needs
Update access to Email Compliance
update-companies. Admin have it by default.If you cannot find this in your sidebar, your workspace may have a custom menu configuration. Contact support and we will check it for you.
How it behaves
Off by default, and warm-up mail is exempt either way
The header and the optional footer message both depend on the same gate: the workspace’s Unsubscribe Link setting has to be on, and the message can’t be warm-up traffic. Turn the setting on and warm-up mail still carries neither the header nor a footer. Only real sends do.The one-click header: what mailbox providers act on
When the setting is on, every real send gets aList-Unsubscribe header carrying two addresses: a mailto: address and an HTTPS URL unique to that message. It also gets a second header, List-Unsubscribe-Post: List-Unsubscribe=One-Click. That second header is the RFC 8058 signal: a provider that honors it (Gmail and Yahoo do) can POST straight to the URL itself, with no page and nothing for the recipient to see.
The URL carries a token: an HMAC-SHA256 hash of the message id, keyed on the app’s own secret. The token is checked before the message is even looked up. A POST carrying an unrecognized or tampered token gets a plain 403 Invalid token and nothing else happens; a good token for a message that no longer exists gets 404 Message not found. A valid POST closes the lead (below) and answers with a plain 200 Unsubscribed successfully: no JSON, no redirect, exactly what the endpoint’s own comment says RFC 8058 requires.
Two things in the header do not follow partner branding. The mailto: address is a single global default (unsubscribe@pipelime.ai, unless an operator has configured a different one) rather than something set per workspace or per brand. The HTTPS address stays on the platform’s own API domain in every workspace, because the mailbox provider is what calls it, not the recipient.
Two more paths, no header token needed
If you write your own opt-out message on Email Compliance, the literal{url} you typed is swapped for the address of the confirmation page for that one message, /unsubscribe/{messageId}. That address carries no token, because confirming on the page stands in for the token. Whatever you wrote around it goes out as a small grey block, divided off by a line, at the bottom of the email. Leave the message empty and no footer text goes out at all; the one-click header keeps working either way.
Some mail clients turn the header’s own URL into something a recipient can click, instead of posting to it invisibly. A GET on that exact same URL checks the token, then redirects (302) to that identical /unsubscribe/{messageId} page. It drops the token on the way, since confirming there takes its place. Both of those addresses are brand-aware: they use the workspace owner’s partner-branding domain when one is set up, and the default app domain when there isn’t.
Either path lands the recipient on the confirmation page covered in The unsubscribe page your recipients see. Submitting it sends an email address back, and that address is compared (case-insensitively, trimmed) against the message’s own recipient. A mismatch is rejected with Email address does not match our records instead of closing anything.
Either way, the lead closes, not just the address
A successful one-click POST and a successful manual confirmation do exactly the same thing:unsubscribed_at is set to now and stage moves to Closed. Unsubscribing an already-unsubscribed lead is a no-op: both handlers check unsubscribed_at first and touch nothing if it’s already set.
Closing the stage, not just flagging the address, is what makes an opt-out outlast the campaign that triggered it. A scheduled campaign email checks unsubscribed_at before it even generates the copy and skips the lead if it’s set; a workflow’s email-send block does the same, recording a skip reason instead of sending. And because it’s stage that moved (not an email-only flag), the same close reaches LinkedIn and WhatsApp campaigns too: both already leave out any lead sitting in Closed when they pick who to message, alongside the leads who booked a meeting or converted. See Automation toggle, closing and reopening leads for what else lands a lead there, and how to reopen one.
Limits
Related
Email Compliance: unsubscribe link and headers
Turn the setting on and write an opt-out message containing
{url}.The unsubscribe page your recipients see
The confirmation form, the success state, and the mismatch error.
Acceptable use for outreach
What you may not send, and how fast an opt-out has to be honoured.
Automation toggle, closing and reopening leads
Pause the AI, close a lead by hand, and understand why one closed on its own.