# Double Opt-In: How Confirmed Opt-In Works

URL: https://email-validation.org/guides/double-opt-in/
Updated: 2026-11-06

> Documentation index: https://email-validation.org/llms.txt

Double opt-in, also called confirmed opt-in, adds a person to your mailing list only after they click a link in a
confirmation email you send right after they sign up. It proves that the person controls the mailbox and wanted your
mail, which keeps typos, fake addresses, bots and spam traps off your list. The cost is a few sign-ups that never
confirm. Yahoo and Microsoft recommend it, and Google asks senders to confirm each address before subscribing it.

## How it works

1. A person enters their address in your sign-up form and ticks a box that was not ticked in advance.
2. Your system stores the address as **pending**, with the time, the form it came from and what the person asked to
   receive.
3. It sends one confirmation email with a unique link.
4. The person clicks the link and confirms. Only now is the address **subscribed**, and only now does marketing mail
   start.
5. Addresses that never confirm are not mailed again, apart from at most a single reminder, and are deleted after a
   set time.

With **single opt-in**, step 4 does not exist: whatever is typed into the form goes straight onto the list.

## Why mailbox providers recommend it

Yahoo's [sender best practices](https://senders.yahooinc.com/best-practices/) recommend double opt-in because it
reduces accidental and malicious sign-ups, fake addresses and most bots, and list it again as a way to reduce invalid
recipients. Microsoft recommends it for marketing email and newsletter sign-ups, with the marketing box unticked by
default and a verification email that lets the person confirm, because then nobody can say they were signed up by
accident ([Troubleshooting mail sent to Microsoft 365](https://learn.microsoft.com/en-us/defender-office-365/external-senders-mail-flow-troubleshooting)).
Google's [email sender guidelines](https://support.google.com/mail/answer/81126) ask senders to confirm each
recipient's address before subscribing them and to avoid opt-in boxes that are checked by default.

M3AAWG, the industry's anti-abuse working group, lists single opt-in forms among the ways spam traps get onto lists
in [Help! I Hit a Spam Trap!](https://www.m3aawg.org/help-i-hit-a-spam-trap). A typo trap such as an address at a
misspelled webmail domain never clicks a confirmation link, so it never joins a double opt-in list.

## Benefits and trade-offs

What you gain:

- **Only working mailboxes.** A confirmed address received your mail at least once, and someone read it.
- **Fewer complaints.** People who confirmed expect your mail, and both Gmail and Yahoo set a limit on the share of
  mail reported as spam ([Gmail and Yahoo sender requirements](https://email-validation.org/guides/gmail-yahoo-sender-requirements/#spam-rate)).
- **No traps, and far fewer bots,** from the form: a trap never confirms, and most bots do not.
- **A record of consent.** The time of the sign-up, the form and the confirmation click show when and how a person
  agreed. M3AAWG describes senders being asked for exactly this kind of data (time and date, form address and IP)
  when a list is audited after trap hits.
- **Protection against list bombing,** where a script signs a victim's address up to many forms at once: without a
  click, the victim gets one confirmation email from you rather than a stream of newsletters.

What it costs:

- **Lost sign-ups.** Some people never open the confirmation email or open it too late. The share varies with the
  audience and with how good your confirmation email is; measure yours.
- **A dependency on one email arriving.** If the confirmation lands in spam or is delayed, the person waits. Send it
  from your own authenticated domain, at once, and as a transactional message.
- **More moving parts:** pending records, tokens, expiry and a confirmation page.

For most marketing lists the trade is worth it, because the addresses you lose are mostly the ones that would have
bounced, never engaged or complained. For mail a person needs to use your product, such as a receipt or a password
reset, a marketing confirmation is not the point, but you still need a working address: that is where validating
the address at sign-up helps.

## How to build it

**Validate before you send the confirmation.** A confirmation email to an address with a typo bounces, and the person
waits for a message that never comes. Check the address when the form is submitted, on your server, and ask the
person to correct it if it is clearly wrong. Our [sign-up form guide](https://email-validation.org/docs/guides/signup-form-validation/) shows how:
block only what is clearly wrong (`invalid`, and [`disposable`](https://email-validation.org/guides/disposable-email-addresses/) if your product
needs a permanent address), offer the
`did_you_mean` suggestion for a [likely typo](https://email-validation.org/guides/email-typos/), and accept everything else. Validation and confirmation answer different
questions: validation says the message can arrive, confirmation says this person owns the mailbox and wants your
mail. Accept a [plus address](https://email-validation.org/guides/plus-addressing/) as typed, and see
[internationalized email addresses](https://email-validation.org/guides/internationalized-email-addresses/) for addresses in other scripts.

**Make the link safe and single-use.** Use a long random token rather than the address or a user id in the link, store
only a hash of it, give it an expiry (for example a few days), and accept it once.

**Confirm with a button, not with the link alone.** Some mail security systems open the links in incoming messages to
scan them. If opening the link is enough to confirm, such a scanner can confirm a sign-up that nobody made. Let the
link open a page with a "Confirm my subscription" button that sends a POST request, and confirm on that request.

**Write a confirmation email people recognize.** Use the same sender name as your website, a subject that says what
it is ("Confirm your subscription to …"), one clear button and a line saying what happens if they ignore it. Keep it
free of marketing content.

**Protect the form.** Rate-limit sign-ups per IP address and per address, and add a bot check if bots find the form
([list bombing](https://email-validation.org/guides/list-bombing/)).
Every confirmation email you send to an address that did not ask for it is a message the recipient can report as
spam.

**Store the evidence.** Keep the sign-up time, the form address, the IP address, the confirmation time and the text
the person agreed to. Delete pending records that never confirm after a fixed period.

**Re-confirm old segments.** Google suggests periodically asking subscribers whether they still want your mail, and
Yahoo suggests reconfirmation emails to inactive subscribers. Remove the ones who do not answer.

## Lists you already have

Double opt-in protects new sign-ups. An existing list collected with single opt-in still holds the typos and dead
addresses of the past. Clean it before you mail it ([how to clean an email list](https://email-validation.org/guides/email-list-cleaning/)): a
[bulk verification](https://email-validation.org/bulk-email-verification/) removes the addresses that would bounce, and a re-permission campaign
to people who have not engaged for a long time, sent only to the addresses that remain, tells you who still wants your
mail.

## Questions

### Is double opt-in required by law?

Rules on consent differ between countries, and this guide is not legal advice. Google notes that some regions
restrict automatic opt-in, such as pre-checked boxes. Double opt-in gives you a strong record of consent wherever you
send, but check the rules that apply to you and your subscribers.

### Is "confirmed opt-in" the same as double opt-in?

Yes. Both names describe the same process: a sign-up followed by a confirmation click. Yahoo uses both terms.

### Do I still need email validation with double opt-in?

Yes, at the form. Validation catches the typo while the person is still on your page, so they can fix it and the
confirmation reaches them. Without it, a mistyped address simply never confirms and you lose the sign-up.

### How long should a confirmation link stay valid?

Long enough for someone who checks mail once a day; a few days is common. No provider sets a number. Delete pending
records that expire, and do not keep mailing them.

## Try it

Try an address in the free [email checker](https://email-validation.org/email-checker/), or test every branch of your sign-up handler with our
free [test addresses](https://email-validation.org/docs/test-addresses/).

## Related

- [Sign-up form validation](https://email-validation.org/docs/guides/signup-form-validation/): the recipe for the form.
- [Glossary: double opt-in](https://email-validation.org/glossary/#double-opt-in).

## Related guides

- [Spam traps explained](https://email-validation.org/guides/spam-traps/)
- [How to clean an email list](https://email-validation.org/guides/email-list-cleaning/)
- [Gmail and Yahoo sender requirements](https://email-validation.org/guides/gmail-yahoo-sender-requirements/)
- [Role-based email addresses](https://email-validation.org/guides/role-based-email-addresses/)
- [List bombing explained](https://email-validation.org/guides/list-bombing/)
- [All guides](https://email-validation.org/guides/)

## Sources

- [Yahoo: Sender best practices](https://senders.yahooinc.com/best-practices/): double opt-in, reconfirmation.
- [Microsoft Learn: Troubleshooting mail sent to Microsoft 365](https://learn.microsoft.com/en-us/defender-office-365/external-senders-mail-flow-troubleshooting):
  double opt-in for marketing email.
- [Google: Email sender guidelines](https://support.google.com/mail/answer/81126): confirming subscribers.
- [M3AAWG: Help! I Hit a Spam Trap!](https://www.m3aawg.org/help-i-hit-a-spam-trap) (February 2023).

## Get up to 500 free credits. No card needed.

New accounts get 500 free credits (100 when you sign up with a free email provider such as Gmail, Outlook or Yahoo, or another personal mailbox such as a paid one like Fastmail or one from your internet provider). Try it on your own list before you buy. [Create your account](https://email-validation.org/signin/?new=1) or [open the free email checker](https://email-validation.org/email-checker/).