Testable criteria for cold email software

RFC 8058 defines one-click unsubscribe. A message carries a List-Unsubscribe header with exactly one HTTPS URI and a List-Unsubscribe-Post header whose value is List-Unsubscribe=One-Click. The message must have a valid DKIM signature covering both headers, and the URI must not answer a POST with a redirect ¹. The older header syntax, angle-bracketed URLs with mailto or http, comes from RFC 2369 ².

Google asks senders of 5,000 or more messages a day to support one-click unsubscribe on marketing mail ³. Yahoo adds that unsubscribe requests should be honored within 2 days ⁴. The test: send yourself a message from the tool, read the raw source, and confirm both headers are present and that the signature header lists them in its h= tag.

1import { readFileSync } from 'node:fs';
2​
3const raw = readFileSync(process.argv.at(2), 'utf8');
4const headerBlock = raw.split(/\r?\n\r?\n/).at(0) ?? '';
5const unfolded = headerBlock.replace(/\r?\n[ \t]+/g, ' ');
6const get = (name) =>
7  unfolded.split(/\r?\n/).find((line) => line.toLowerCase().startsWith(name + ':'));
8​
9const unsub = get('list-unsubscribe') ?? '';
10const post = get('list-unsubscribe-post') ?? '';
11const sig = get('dkim-signature') ?? '';
12const signed = (sig.match(/\bh=([^;]*)/i)?.at(1) ?? '').toLowerCase();
13​
14const results = {
15  httpsUri: /<https:\/\/[^>]+>/i.test(unsub),
16  oneClickPost: /List-Unsubscribe=One-Click/.test(post),
17  signedUnsub: signed.includes('list-unsubscribe'),
18  signedPost: signed.includes('list-unsubscribe-post'),
19  oneFromHeader: unfolded.split(/\r?\n/).filter((l) => /^from:/i.test(l)).length === 1,
20};
21console.table(results);
22process.exitCode = Object.values(results).every(Boolean) ? 0 : 1;

The last line of the script covers a related rule in RFC 5322: the From field appears exactly once ⁵.

Enhanced status codes carry three numbers: a class, a subject and a detail. Class 4 is a persistent transient failure where a retry may work, class 5 is a permanent failure that resending will not fix, and 5.1.1 means the destination mailbox does not exist ⁶. RFC 5321 also says a relay that accepts a message and later finds it undeliverable must send a non-delivery notification to the originator, so a good tool parses those later notices and not only the immediate SMTP reply ⁷.

Per-domain throttling has no standard to cite, so test the behavior directly. The reason to want it is the complaint ceiling: a single noisy sending domain should be pausable without stopping the rest.

A validation hook is the cheapest control. Checking a domain before import removes addresses that can never receive mail, such as a domain that publishes a null MX or has no mail host. The email-domain-check product returns those signals from public DNS and open lists, and it does not contact the mail server, so it cannot prove a mailbox exists.

1curl -X POST https://YOUR_API_HOST/v1/email-domain-check \
2  -H "Authorization: Bearer $LOOKVALID_API_KEY" \
3  -H "Content-Type: application/json" \
4  -d '{"email":"info@example.com"}'

A captured response for that address reports null_mx: true, role_account: true and a deliverability_signal of undeliverable. A tool that cannot act on a field like that before sending fails the first row of the table.

1. Run every row of the table against each candidate and record pass or fail, not a score.
2. Drop any tool that fails unsubscribe headers or bounce handling, since both affect every message.
3. Break ties on validation hooks and export access, which decide how well the tool fits the rest of your stack.

To wire address checks into whichever tool you pick, follow the quickstart or read the email-domain-check reference.