I'm writing a mailing list manager program. For unsubscribing, I'm considering using HMACs of email addresses with secret keys to generate unsubscribe links. This key would be generated randomly one time on the server and then used for all links from that time on. Links would have this format:

https://list.example.com/unsubscribe?address={email_address}&token={hmac(email_address, secret_key)}

I'm writing a mailing list manager program. For subscribing and unsubscribing, I'm considering using HMACs of email addresses with secret keys to generate unsubscribe links. This key would be generated one time on the server and then used for all links from that time on. Links would have this format:

https://list.example.com/unsubscribe?address={email_address}&token={hmac(email_address, secret_key)}

When someone subscribes through my web form, my server will send an email with one of these links. When they click the link to confirm their subscription, I need to verify that my server actually sent it.