- Shipped
- September 12, 2026 at 7:03 PM UTC
- Author
- Kamo
- Commit
- 48f0d33
Every bulk and shared-article message offered unsubscribe@<sender's domain> in its List-Unsubscribe header, but nothing read that mailbox - for a tenant it was not even our domain - so every opt-out sent that way was lost. - The mailto now names unsubscribe@hello.kamocrm.com **************** for every org, with the recipient's token in the subject: **************** The https one-click link and List-Unsubscribe-Post are unchanged. - POST /api/internal/unsubscribe/mail takes what arrives there, as reported by the mail server's sidecar. It finds the token in the plus-address, the subject (with Re:, in capitals, left URL-encoded, or RFC 2047 encoded) or a forwarded link, resolves it exactly as the preference page does, and unsubscribes that address for that org through the opt-out ledger (source "mailto", with the Message-ID). A campaign row still waiting to be sent is pulled, as with the one-click link. Doing it twice changes nothing. - A message without a token that names somebody changes nothing: nobody is unsubscribed by a guess from the From address, which anyone can write. Nothing is ever sent back. The log keeps the outcome, org, sender domain and Message-ID, never the subject or body. - It sits behind InternalAuthFilter like the rest of /api/internal, refuses requests over 64 KiB, and tries at most five candidate tokens per message.