Double opt-in, and why it's on by default
One extra click that makes every other protection work.
With double opt-in, someone who submits a form gets an email asking them to confirm. Only when they click are they subscribed and added to your lists. It’s on by default on every form.
What the extra click buys you
- Bot signups become harmless. An unconfirmed address is never mailable, so junk submissions sit inert instead of becoming bounces.
- Typos never bounce. Someone who mistypes their address never confirms, so it never enters your audience.
- Nobody can subscribe someone else. Only the person holding the mailbox can complete it — which also stops your form being used to harass a third party.
- You get proof. A confirmed signup is evidence of consent that survives a complaint.
The result is a smaller list that performs better: engagement is what mailbox providers judge you on, and a list of people who deliberately confirmed engages far more than one padded with typos.
What it costs
Honestly: some people don’t confirm. Expect to lose a slice of signups — the confirmation lands in spam, or they get distracted.
Two things move that number more than anything else:
- Say what will happen. Your after-submit message should tell them to go and check their email, right now.
- Make the confirmation email plain. One sentence and one obvious link.
The confirmation is sent as you
Your name in the From line, not ours
The email says “confirm your subscription to your business”, and comes from your sending address. A confirmation arriving from an unfamiliar brand is one people report rather than confirm.
You don’t need a verified domain for this one message — requiring DNS work before anyone can sign up would make forms unusable on day one — but verifying yours makes it land better.
Turning it off
You can. Submitting then subscribes immediately, and the form warns you what you’re giving up.
It occasionally makes sense — a form behind a login, where you already know who someone is. On a public page it hands anyone a way to put any address into your audience, and every bounce and complaint that follows lands on your reputation.
Common issues
Submissions high, confirmations low
Check your after-submit message actually tells people to look for the email. If the gap is very large, the confirmation may be landing in spam — verifying your own sending domain is the biggest single fix.
Someone says they confirmed but isn't subscribed
Confirmation links are single-use. If they’d already confirmed, the second click does nothing visible. Check the contact — they’re probably fine.
Can I resend a confirmation?
Not yet. Ask them to submit the form again — it sends a fresh one.
FAQs
Is double opt-in legally required?+
It depends where your recipients are — in some places it is effectively expected, elsewhere it isn’t. It is the easiest way to be able to prove consent anywhere, which is the part that matters when someone complains.
Do unconfirmed signups count towards anything?+
They sit as contacts who never opted in, and they cost nothing — they’re never mailed, so they’re never charged for.
How long do people have to confirm?+
There’s no hard deadline, but a confirmation clicked weeks later is unusual. If a form’s confirmation rate is poor, the message people see immediately after submitting is where to look first.