A contact list is only as good as the way it was collected. You can have flawless infrastructure, with SPF, DKIM and DMARC configured perfectly, and still land in spam because the list contains wrong addresses, people who don't remember subscribing or trap mailboxes. Double opt-in is the simplest way to avoid almost all of these problems at the source.
What it means
With single opt-in, an address typed into a form joins the list immediately. With double opt-in, the subscription stays pending until the user clicks a link in a confirmation email sent to that address. Only after the click does the contact become active.
The extra step proves two things: that the mailbox exists and that whoever controls it really wants the messages. It may seem minor, but it eliminates at the root:
- typos, such as a misspelt domain;
- addresses entered by someone else, as a joke or out of spite;
- automated sign-ups by bots;
- many spam traps, which by definition never click confirmation links.
The cost and the gain
The most common objection is that some people never confirm, so the list grows more slowly. True, but the addresses that don't confirm are precisely the ones that would have produced bounces, complaints and poor engagement. A smaller list of interested people performs better than a larger, dirty one, both for delivery and for response.
There is a less visible benefit too: with double opt-in, the first message the user receives is the one they have just requested. The provider sees an expected email, opened and clicked a few seconds after it was sent, which is a positive signal for the sender's reputation.
Writing a confirmation email that works
The confirmation email is often neglected, yet it has the highest open rate of the entire relationship. Some practical rules:
- a clear subject that says what to do: «Confirm your newsletter subscription»;
- a recognisable sender, the same name the user saw on the form;
- a single button, clearly visible, with the same link repeated as text;
- one line on what they will receive and how often;
- a sentence for anyone who asked for nothing: «If you didn't sign up, just ignore this message»;
- immediate sending, because someone who has just signed up is waiting.
The page that opens after the click must confirm the subscription unambiguously. It is also the right moment to ask people to add the sender to their contacts.
Mistakes to avoid
- Adding promotional content to the confirmation email: it must remain a service message.
- Leaving confirmation links that never expire: it is good practice to give them a limited validity, say a few days.
- Sending several reminders: one at most, after a day or two, then the pending subscription should be deleted.
- Treating a mere open as confirmation: only the click on the link counts.
That last point has become more important since some mail clients download images automatically to protect privacy: an open measured that way proves nothing.
Watch out for links opened by filters
Some corporate security systems automatically follow the links in emails to check whether they are dangerous. If the confirmation link activates the subscription with a simple request, a filter can confirm on the user's behalf. To prevent this, the page reached by the link can show a button that submits the confirmation as a separate request: a person presses it, a scanner usually does not.
Keeping proof of consent
The European data protection regulation requires the controller to be able to demonstrate consent. Double opt-in helps a great deal, provided the right data is kept. For each subscriber it is worth recording:
| Data | Why it matters |
|---|---|
| date and time of sign-up | reconstructing the sequence |
| date and time of confirmation | proving the address was verified |
| source form or page | knowing what was shown |
| text of the notice and checkboxes at that moment | proving what the user accepted |
| IP address and user agent, if your privacy notice allows it | linking the action to a session |
Without this data, double opt-in remains useful for list quality but loses much of its value as evidence.
What about existing customers?
People who have already bought a product don't always go through a sign-up form. In many jurisdictions, Italy included, the law allows sending communications about similar products to customers who provided their address during a purchase, as long as they can object easily in every message. Even then, quality matters: anyone who never opens anything should be handled with the same hygiene rules as any other contact.
In short
- Double opt-in activates a contact only after a click on a confirmation link.
- It removes typos, fake sign-ups, bots and many spam traps.
- The confirmation email must be immediate, clear and free of promotional content.
- To withstand link scanners, confirmation can require an explicit action on the page.
- Confirmation date, source and accepted text should be kept as proof of consent.
