Double opt-in

Double opt-in means a new subscriber is not active until they click a link in a confirmation email. This page explains what that changes, what it costs, and how to set it up so the confirmation actually reaches the inbox.

What it is#

With single opt-in, someone submits your form and becomes an active contact immediately. The next campaign you send goes to them.

With double opt-in, the same submission creates a contact in an unconfirmed state and sends one email containing a confirmation link. Nothing else goes to that address. When the subscriber clicks the link, the contact becomes active and starts receiving campaigns and any automations set to run for that list. If they never click, they stay unconfirmed and you never mail them.

Turn it on for the list you are collecting into before you publish a form that feeds it. It applies to people who join after you turn it on, not retroactively to contacts you already have.

The tradeoff, stated plainly#

You will have fewer contacts. Some share of people who fill in your form never confirm. They mistype the address, the email lands in spam, they get distracted, or they were never that interested. The exact loss depends on your audience and how well your confirmation email lands, so measure your own rather than trusting a number from a blog post.

What you get in return is worth more than the count. Three concrete things:

• Typos and fake addresses never enter your list. Nobody confirms an address they mistyped, and nobody confirms an address they invented to get past your form. Those addresses would otherwise hard bounce, and hard bounces are what mailbox providers use to decide whether you know who your recipients are.
• Spam traps mostly stop at the door. A recycled or fabricated address in your signup flow will not click a confirmation link. Kept on a list, it eventually receives mail and damages your sending reputation.
• You have a record of consent. A confirmed subscription is a timestamped action taken from the subscriber's own mailbox. That is a defensible answer to a complaint or a request to show why you were mailing someone, in a way that "they filled in a form once" is not.

The list you end up with is smaller and it opens more. Your bounce and complaint rates go down, which is what moves inbox placement.

When it is effectively required#

Rules differ by country and by the kind of mail you send, and this page is not legal advice. Check what applies to you, and see GDPR and your data for how consent records work in the product.

That said, there are situations where turning it on is the practical answer regardless of what the minimum standard is:

• You need to demonstrate consent, not assert it. Where the burden is on you to show that a person agreed, a confirmation click is the cleanest evidence you can hold.
• Your form is public and unprotected. Any form reachable by a bot will collect addresses that never asked for anything, including addresses signed up maliciously. Confirmation stops those before they reach your list.
• You are sending from a new domain or rebuilding a damaged reputation. In that state you cannot afford bounces.
• Signups come from somewhere you do not control, such as a partner site, a giveaway, or an event where someone else transcribed addresses.
• You collect from many regions at once. Applying the strictest standard to everyone is safer than varying the flow by geography.

What the confirmation email should say#

This email has one job. Treat it as a functional message, not a marketing one.

• Say what they signed up for, in their words. "You asked for the weekly email from [your company]" tells someone who forgot which form they filled in.
• Make the link the obvious next action. One prominent link or button. Put it above the fold. Additional links compete with it and lower confirmation rates.
• Say what happens after they click. What they will receive and roughly how often.
• Say what to do if it was not them. "If you did not sign up, ignore this email and you will not hear from us again." This is both honest and useful, because malicious signups do happen.
• Keep it short and mostly text. A heavy image-based template is more likely to be filtered, and there is nothing here that needs a design.

Do not use this email to deliver the thing you promised. If someone signed up for a download, deliver it after they confirm. Attaching the reward to the unconfirmed email removes their reason to click.

Keeping the confirmation out of spam#

The confirmation email is the one message you cannot afford to have filtered, and it is going to an address with no sending history with you at all.

• Authenticate the sending domain with SPF, DKIM, and DMARC before you start collecting. This is the largest single factor. See Deliverability overview.
• Send it from a recognizable address on your own domain, not a no-reply address at a domain the subscriber has never seen.
• Make the subject line literal. "Confirm your subscription" reads as transactional and is what people are looking for. Subject lines with urgency, prizes, or excess punctuation get filtered.
• Keep links to a minimum and point them at your own domain. A confirmation email full of links elsewhere looks like the pattern filters are built to catch.
• Tell people to look for it. Say on your thank-you page that the confirmation is on its way, name the address it comes from, and mention the spam folder. This recovers a real portion of otherwise lost signups.

If confirmations are not coming through#

Almost nobody confirms. Send yourself through the form using a mailbox at a large consumer provider and see where the email lands. If it is in spam, treat it as a deliverability problem, starting with domain authentication.

A few specific people say they never got it. Ask them to check spam, then check for a typo in the address on your list. You cannot resend to an address that was typed wrong.

Contacts sit unconfirmed for weeks. They are not going to confirm. Leaving them costs nothing, since they are never mailed, but do not count them as an audience.