A message can have a valid DKIM signature while its unsubscribe fields are unsigned. That is a meaningful gap: a receiver verifying the message has not necessarily verified the advertised opt-out action. Inspect the signature's coverage, not only a generic DKIM pass label.
Locate the signature that protects the operation
RFC 8058 requires at least one valid DKIM signature covering List-Unsubscribe and List-Unsubscribe-Post. Both fields must appear in the h= tag of that valid signature. A missing required signature is a reason for the receiver not to offer one-click unsubscribe under the specification. RFC 8058 section 4.
A message may carry multiple signatures. Do not combine the validity of one with the header coverage of another and call the pair sufficient. Identify a single valid signature that covers the required fields, then retain its signer, selector and verification result. This is separate from checking which signature contributes to DMARC alignment.
Place the headers before the relevant signing step
Map the message construction pipeline: application template, list processing, gateway transformations, signer and final outbound route. If a service adds the unsubscribe fields after signing, an earlier signature may remain valid without covering them. The fix is to place the fields before the appropriate signature or ensure a later valid signature covers them.
Read the final emitted message. RFC 6376 defines the h= list and header selection rules, including how repeated field names are handled. A string search for “list-unsubscribe” anywhere in the message is not a coverage test. Duplicate fields and transformations require careful inspection of the actual signature input. RFC 6376 sections 3.5 and 5.4.
Distinguish signed and unsigned changes
Imagine a controlled test message whose otherwise valid signature covers both unsubscribe fields. Changing the signed URI to a different value changes the signed input; under normal DKIM verification, the original signature no longer validates that altered input. By contrast, a signature that omits both fields can remain valid after those unsigned values change. This explains why a generic pass cannot authenticate every field.
These are protocol-based expectations, not an executed cryptographic fixture. An actual authorized mutation test needs exact original bytes, the selected signature and the correct verification key. An injected test key demonstrates only that test’s cryptographic relationship, not public DNS provenance or the historical receiving result. Preserve the original and mutate a separate copy.
Check the whole signed path
After fixing coverage, resend an authorized test message through the intended route and verify at the receiving side. Link rewriting, gateway edits or a later list processor can change a covered field. Preserve the pre-transformation and final samples when possible so the owner can locate the first stage where verification diverges.
Avoid solving the problem by simply removing the fields from h=. That can make the signature easier to preserve while leaving the RFC 8058 requirement unmet. If a gateway must transform the action, coordinate the final signing boundary and ensure the transformed URI still maps to the correct recipient and list.
Complete the operational check
Signature coverage authenticates the advertised fields; it does not prove the endpoint performs the requested suppression. Use a controlled subscription to test the POST and downstream next-send exclusion separately. Conversely, a working endpoint does not repair missing signature coverage.
The closure record should identify the valid covering signature, exact final message, endpoint scope and observed suppression result. Keep provider UI display as a separate observation rather than a promised consequence of correct signing.
Retain a signature-specific closure record
Record the final message, signer, selector, the two covered fields and the verification outcome for that particular signature. Record endpoint and suppression results separately. If a later gateway mutates the fields, repair the signing boundary rather than dropping required coverage.