Double opt-in (confirmed opt-in)

Double opt-in, also called confirmed opt-in, adds a person to your mailing list only after they click a link in a confirmation email you send right after they sign up. It proves that the person controls the mailbox and wanted your mail, which keeps typos, fake addresses, bots and spam traps off your list. The cost is a few sign-ups that never confirm. Yahoo and Microsoft recommend it, and Google asks senders to confirm each address before subscribing it.

How it works

1. A person enters their address in your sign-up form and ticks a box that was not ticked in advance.
2. Your system stores the address as pending, with the time, the form it came from and what the person asked to receive.
3. It sends one confirmation email with a unique link.
4. The person clicks the link and confirms. Only now is the address subscribed, and only now does marketing mail start.
5. Addresses that never confirm are not mailed again, apart from at most a single reminder, and are deleted after a set time.

With single opt-in, step 4 does not exist: whatever is typed into the form goes straight onto the list.

Why mailbox providers recommend it

Yahoo's sender best practices recommend double opt-in because it reduces accidental and malicious sign-ups, fake addresses and most bots, and list it again as a way to reduce invalid recipients. Microsoft recommends it for marketing email and newsletter sign-ups, with the marketing box unticked by default and a verification email that lets the person confirm, because then nobody can say they were signed up by accident (Troubleshooting mail sent to Microsoft 365). Google's email sender guidelines ask senders to confirm each recipient's address before subscribing them and to avoid opt-in boxes that are checked by default.

M3AAWG, the industry's anti-abuse working group, lists single opt-in forms among the ways spam traps get onto lists in Help! I Hit a Spam Trap!. A typo trap such as an address at a misspelled webmail domain never clicks a confirmation link, so it never joins a double opt-in list.

Benefits and trade-offs

What you gain:

• Only working mailboxes. A confirmed address received your mail at least once, and someone read it.
• Fewer complaints. People who confirmed expect your mail, and both Gmail and Yahoo set a limit on the share of mail reported as spam (Gmail and Yahoo sender requirements).
• No traps, and far fewer bots, from the form: a trap never confirms, and most bots do not.
• A record of consent. The time of the sign-up, the form and the confirmation click show when and how a person agreed. M3AAWG describes senders being asked for exactly this kind of data (time and date, form address and IP) when a list is audited after trap hits.
• Protection against list bombing, where a script signs a victim's address up to many forms at once: without a click, the victim gets one confirmation email from you rather than a stream of newsletters.

What it costs:

• Lost sign-ups. Some people never open the confirmation email or open it too late. The share varies with the audience and with how good your confirmation email is; measure yours.
• A dependency on one email arriving. If the confirmation lands in spam or is delayed, the person waits. Send it from your own authenticated domain, at once, and as a transactional message.
• More moving parts: pending records, tokens, expiry and a confirmation page.

For most marketing lists the trade is worth it, because the addresses you lose are mostly the ones that would have bounced, never engaged or complained. For mail a person needs to use your product, such as a receipt or a password reset, a marketing confirmation is not the point, but you still need a working address: that is where validating the address at sign-up helps.

How to build it

Validate before you send the confirmation. A confirmation email to an address with a typo bounces, and the person waits for a message that never comes. Check the address when the form is submitted, on your server, and ask the person to correct it if it is clearly wrong. Our sign-up form guide shows how: block only what is clearly wrong (invalid, and disposable if your product needs a permanent address), offer the did_you_mean suggestion for a likely typo, and accept everything else. Validation and confirmation answer different questions: validation says the message can arrive, confirmation says this person owns the mailbox and wants your mail. Accept a plus address as typed, and see internationalized email addresses for addresses in other scripts.

Make the link safe and single-use. Use a long random token rather than the address or a user id in the link, store only a hash of it, give it an expiry (for example a few days), and accept it once.

Confirm with a button, not with the link alone. Some mail security systems open the links in incoming messages to scan them. If opening the link is enough to confirm, such a scanner can confirm a sign-up that nobody made. Let the link open a page with a "Confirm my subscription" button that sends a POST request, and confirm on that request.

Write a confirmation email people recognize. Use the same sender name as your website, a subject that says what it is ("Confirm your subscription to …"), one clear button and a line saying what happens if they ignore it. Keep it free of marketing content.

Protect the form. Rate-limit sign-ups per IP address and per address, and add a bot check if bots find the form (list bombing). Every confirmation email you send to an address that did not ask for it is a message the recipient can report as spam.

Store the evidence. Keep the sign-up time, the form address, the IP address, the confirmation time and the text the person agreed to. Delete pending records that never confirm after a fixed period.

Re-confirm old segments. Google suggests periodically asking subscribers whether they still want your mail, and Yahoo suggests reconfirmation emails to inactive subscribers. Remove the ones who do not answer.

Lists you already have

Double opt-in protects new sign-ups. An existing list collected with single opt-in still holds the typos and dead addresses of the past. Clean it before you mail it (how to clean an email list): a bulk verification removes the addresses that would bounce, and a re-permission campaign to people who have not engaged for a long time, sent only to the addresses that remain, tells you who still wants your mail.

Questions

Is double opt-in required by law?

Rules on consent differ between countries, and this guide is not legal advice. Google notes that some regions restrict automatic opt-in, such as pre-checked boxes. Double opt-in gives you a strong record of consent wherever you send, but check the rules that apply to you and your subscribers.

Is "confirmed opt-in" the same as double opt-in?

Yes. Both names describe the same process: a sign-up followed by a confirmation click. Yahoo uses both terms.

Do I still need email validation with double opt-in?

Yes, at the form. Validation catches the typo while the person is still on your page, so they can fix it and the confirmation reaches them. Without it, a mistyped address simply never confirms and you lose the sign-up.

How long should a confirmation link stay valid?

Long enough for someone who checks mail once a day; a few days is common. No provider sets a number. Delete pending records that expire, and do not keep mailing them.

Try it

Try an address in the free email checker, or test every branch of your sign-up handler with our free test addresses.

Related

• Sign-up form validation: the recipe for the form.
• Glossary: double opt-in.

Related guides

• Spam traps explained
• How to clean an email list
• Gmail and Yahoo sender requirements
• Role-based email addresses
• List bombing explained
• All guides

Sources

• Yahoo: Sender best practices: double opt-in, reconfirmation.
• Microsoft Learn: Troubleshooting mail sent to Microsoft 365: double opt-in for marketing email.
• Google: Email sender guidelines: confirming subscribers.
• M3AAWG: Help! I Hit a Spam Trap! (February 2023).

How we wrote this: drafted by the email-validation.org team with the help of AI writing tools, from our product documentation and the sources linked in the text.