Double opt-in: why we default to it (the math)

Our playbook defaults every list to double opt-in, and the reason is arithmetic, not principle. Google's bulk sender rules (February 2024, tightened since) set the spam complaint target at 0.1% and the hard ceiling at 0.3%. On a 500-person list, one complaint puts you at 0.2%. One.

What double opt-in is, in one paragraph

Someone submits your form. They go into a pending state. A confirmation email arrives with one link. They click it, and only then are they subscribed; no click, no newsletter, ever. Single opt-in skips the middle: form straight to list. That is the whole mechanic. The argument is about what the click buys you, and in our guide to starting a newsletter on your own domain it sits at step one of list building, before the first issue exists.

The complaint budget

Your spam complaint rate is the share of your delivered mail that recipients mark as spam, and Gmail tracks it per sending domain. The Google thresholds are unforgiving at small scale because the denominator is small. Here is the arithmetic nobody runs until it is too late:

At or above 0.3%, Gmail withholds delivery mitigation until you have stayed under 0.3% for 7 consecutive days. That is not a warning shot; it is a spam-folder sentence with a minimum term. Our own send path does not leave this to judgment: it pauses itself automatically at a 0.3% complaint rate or a 2% bounce rate, with no human in the loop.

Double opt-in is complaint prevention at the door. The people most likely to hit "Report spam" are people who never asked for your mail, and an unconfirmed form is how those people get on your list.

What actually lands on an unconfirmed list

Four things, and only one of them is a reader.

Bots. Signup forms get found and stuffed. Automated submissions replay real strangers' addresses against every open form they find, which means your newsletter arrives cold in the inbox of someone who has never heard of you. Some of them mark it spam. That is the complaint budget, gone.

Typos. A transposed letter turns a fan into a hard bounce, and Google wants your bounce rate under 2%. Worse, the typo sometimes belongs to a real stranger.

Spam traps. Recycled addresses that mailbox providers and blocklist operators watch. A trap never clicks a confirmation link, so double opt-in filters traps by construction. It is the only list-building mechanism that does.

Role accounts. info@, admin@, postmaster@, abuse@. Nobody subscribes a shared ops mailbox to a newsletter on purpose. Our signup playbook rejects these at the form, on top of the confirmation step.

The single opt-in cases that hold up

Paid products. A customer who just paid you is not an ambiguous signup; the card is the consent evidence, and the receipt has to be delivered anyway. The remaining risk is typos, so validate the address at entry. A paying customer with a misspelled email is a support ticket, not a subscriber.

In-person signups. A clipboard at your market stall, a signup sheet at a talk. Intent is not in question; handwriting is. Defensible if the first email goes out within a day and every bounce is pruned immediately.

That is the whole list. Anything incentivized runs the other way: lead magnets and giveaways attract exactly the throwaway addresses and bots that confirmation exists to filter. Confirm those, always, even though it costs signups. Especially because it costs signups.

Implementation details that matter

The confirmation email has one job, so it should look like it has one job:

Subject: Confirm your subscription to [Newsletter]

You (or someone using your address) signed up for
[Newsletter] at [yoursite.com]. One click and you're in:

    [Confirm subscription]

Button not working? Paste this into your browser:
https://yourdomain.com/confirm?t=...

Didn't sign up? Ignore this and nothing more will arrive.

Send it from the same real address the newsletter will use, so the sender the subscriber confirms is the sender who shows up later. Put no marketing in it: German practice treats promotional content inside a confirmation email as unsolicited advertising, and the sterile version converts fine because the reader asked for it eight seconds ago. The confirmation is also part one of a two-part welcome; part two fires on the click, and we wrote out both halves in welcome email examples.

Expire the link. 48 hours is generous; a click on a three-week-old token is stale intent, and expiry keeps your pending table honest. Resend etiquette is one reminder, about 24 hours after the first email, then delete the pending record. The move to resist is quietly promoting unconfirmed addresses onto the live list because the numbers look nicer. That trades a vanity count for complaint risk at your most fragile stage.

Store the evidence: signup timestamp and source form, confirmation timestamp, token. Three fields, kept forever.

The GDPR angle

GDPR never uses the words "double opt-in." What Article 7(1) requires is that you can demonstrate the subscriber consented: when, to what, told what. Current guidance from the consent-management vendors iubenda and Usercentrics (both checked August 2026) agrees on the shape of it: the regulation does not mandate confirmation clicks anywhere, and Germany is the practical exception, where courts and data protection authorities treat double opt-in as the standard evidence of valid consent.

Which is the point. A confirmation click with two timestamps turns "can you prove consent?" from a legal scramble into a database query. If your list includes EU subscribers, and any open form's list eventually does, double opt-in is the cheapest compliance artifact you will ever generate.

The cost, stated honestly

Double opt-in loses signups. Some people never click the confirmation, whether from a spam-foldered email, a closed tab, or fading interest. That is the fee, and pretending otherwise would be the kind of claim we ban from our own pages. Our position is that a subscriber who will not click one link inside a minute of asking for your newsletter was not going to click anything you sent later either. You are pre-paying churn at the moment it is cheapest.

Turn it on before the list exists. Retrofitting confirmation onto a dirty list means re-permissioning people who forgot you, and most will not click twice. Default to double opt-in, make exceptions consciously for money and handshakes, and prune those excepted lists twice as hard.