Most email deliverability problems are planted on the day an address enters your list. A mistyped domain becomes a bounce. A bot submission becomes a spam trap hit. A person who did not understand what they were joining becomes a complaint. A well-built double opt-in flow and a careful sign-up form prevent a large share of these problems before you send a single campaign. This guide covers how to design the form, how to protect it, when to use confirmed opt-in, what to record and how to write the first two emails a new subscriber receives.
Single opt-in versus double opt-in
| Single opt-in | Double (confirmed) opt-in | |
|---|---|---|
| Flow | Address is added as soon as it is submitted | Address is added after the person clicks a link in a confirmation email |
| List growth | Faster | Slower, with some drop-off |
| Typos and bots | Reach the list | Mostly filtered out |
| Proof of consent | Weaker; relies on the form record | Stronger; shows the owner of the mailbox agreed |
| Bounce and complaint risk | Higher | Lower |
| Suits | Low-risk forms, existing customers, logged-in users | Public forms, newsletters, contests, large or high-value lists |
Neither is right for everyone. Many senders use single opt-in for customers who are logged in and have already verified their address, and confirmed opt-in for open public forms. Whichever you choose, make the decision on purpose and record it.
Design the form
Make the promise clear
Tell people what they will get and how often, in words next to the button. "Our monthly product update, plus occasional guides" sets an expectation. "Subscribe" does not. People who know what they signed up for rarely complain. Show the sender name, and link to a privacy notice that explains what you do with the address.
Ask for as little as you need
Every extra field reduces completion. An address is usually enough. If you need more, such as a first name or topics of interest, ask for it after the first step or in the welcome email.
Do not pre-tick consent
A box that is already ticked, or consent bundled with a purchase, weakens your position and annoys people. Leave it unticked and use plain wording.
Check the address as it is typed
- Validate the format with a simple check. Do not try to write a perfect pattern, because valid addresses are more varied than most patterns allow.
- Offer a suggestion for common domain typos, such as a missing letter in a well-known domain, and let the person correct it.
- Trim spaces and convert the domain part to lower case.
- Consider a second field only if you see many typos. It adds friction.
Protect the form from abuse
Public forms attract abuse. The two main problems are bots that fill forms with junk, and attackers who submit the addresses of other people to flood them with confirmation emails. Layer simple defences first and add heavier ones when you see a problem.
| Defence | What it stops | Cost to users |
|---|---|---|
| Hidden honeypot field | Simple bots that fill every field | None |
| Rate limit per IP address and per address | Bursts and repeated submissions | None for normal use |
| Time check (form submitted too fast) | Scripts | None |
| Challenge (CAPTCHA or similar) | More advanced bots | Some friction; use when abuse is visible |
| Confirmation email | Fake and mistyped addresses | One extra step |
| Block disposable domains if they hurt you | Throwaway addresses | May turn away privacy-minded people |
Keep the confirmation email boring. If your confirmation message contains promotions, then list bombing sends your marketing to people who never asked. Keep it plain, short and limited to the confirmation.
The confirmation email
The confirmation message does one job. Send it immediately, from a recognisable sender, with a subject that says what it is. Put a single button or link at the centre, state which site and list the person is confirming, and include a line for anyone who did not sign up.
Subject: Please confirm your subscription to Example Updates
Hi,
Someone entered this address on example.com to receive our monthly product update.
[ Confirm my subscription ]
If this was not you, ignore this message and you will not be subscribed.- Make the link unique and unguessable, and let it expire after a reasonable period.
- Allow a way to request a new link if it has expired.
- Do not add the person to marketing lists until they confirm.
- Treat the confirmation message as a transactional message, and send it from a stream suited to that. See separating transactional and marketing streams.
- Send at most one reminder, after a day or two, and then stop.
Record consent properly
If a mailbox provider, a regulator or the subscriber asks how you got an address, you should be able to answer. Store a consent record for each subscriber at the time of sign-up.
| Field | Example | Why |
|---|---|---|
| Address | name@example.net | Identifies the subscriber |
| Timestamp | 2026-09-14 10:32 UTC | Shows when consent was given |
| Source | Newsletter form on the pricing page | Shows where the person signed up |
| Wording shown | Version of the text beside the button | Shows what the person agreed to |
| Confirmation event | Time of the click on the confirmation link | Proves the mailbox owner agreed |
| IP address and user agent (if you keep them) | Technical context | Helps investigate disputes; treat as personal data |
Laws on consent and marketing email differ by country, and examples include the GDPR in Europe, CAN-SPAM in the United States and India's Digital Personal Data Protection Act 2023. They have different rules, and this guide is not legal advice. Our article on GDPR, consent records and unsubscribes goes further on records.
The welcome email
The first message after confirmation is usually the most opened and the most remembered. Use it to confirm what the person will get, how often and how to change it. Include a link to preferences and a clear unsubscribe link. If you promised something, such as a guide, deliver it right away. Invite a reply: a simple question about what the person hopes to learn encourages engagement, which helps your reputation. Avoid sending a long series of promotions in the first days.
Measure the sign-up flow
| Metric | What it tells you | Action if poor |
|---|---|---|
| Form completion rate | Whether the form is too long or unclear | Remove fields; clarify the promise |
| Confirmation rate | Whether people see and act on the email | Check deliverability of the confirmation; improve the subject |
| Bounce rate of the first send | Quality of addresses | Add typo checks; review sources |
| Complaint and unsubscribe rate in the first 30 days | Whether the promise matched reality | Adjust wording and frequency |
| Bot sign-up bursts | Abuse of the form | Add rate limits and a challenge |
If the confirmation messages themselves land in spam, new subscribers never confirm. Check authentication with authenticating your sending domain, and use the spam troubleshooting checklist if they do.
A worked example: from 2,000 sign-ups to 1,400 confirmed
A software company runs a public newsletter form on its blog. In a month it records 2,000 sign-ups. About 120 are from a burst of near-identical addresses in a few minutes, and several others have domain typos. The company enables a honeypot field and a rate limit, and switches to confirmed opt-in with a typo prompt on the address field. In the following month, 1,550 people submit the form and 1,400 confirm. The confirmed list has a far lower bounce rate on the first campaign, and the first send gets no spam trap complaints. The list is smaller than before, but each address is a person who asked for the mail.
The figures are illustrative. The pattern is common: the unconfirmed tail contains the addresses that damage reputation. For what to do with subscribers who later stop engaging, see list hygiene and sunset policies.
Reviewing a sign-up flow? Share the form and the problem you see and we will suggest where to start.
Further reading and sources
Frequently asked questions
What is double opt-in?
Double opt-in, also called confirmed opt-in, means a person first submits their address and then confirms it by clicking a link in an email sent to that address. Only confirmed addresses are added to your mailing list.
Is double opt-in required by law?
It depends on where you and your recipients are. Many laws require valid consent and an easy way to opt out without prescribing double opt-in. Some markets and industry practices favour it. This is not legal advice, so check the rules that apply to you.
Does double opt-in reduce my list size?
Yes, because some people never click the confirmation. Those people often include mistyped addresses and bots, so the confirmed list usually has lower bounce rates and fewer complaints. Whether that trade-off suits you depends on your goals.
How do I stop fake sign-ups?
Use several layers: a hidden honeypot field that humans never fill in, rate limiting by IP address, a challenge on public forms when abuse appears, and confirmation emails. Watch for sudden bursts of sign-ups as a sign of attack.
Why are bots signing up with real addresses?
Attackers sometimes submit other people addresses to flood their inboxes with confirmation messages, a practice called list bombing. Rate limits, challenges and a confirmation email that does not contain marketing content reduce the harm.
What should I store as proof of consent?
At minimum the address, the date and time, the source page or form, the exact wording that was shown and the confirmation event if you use one. Keep the record for as long as you mail the person.
How long should the confirmation link last?
Long enough for a normal person to find the email, for example a day or several days, and short enough that old links are not a risk. Offer a way to request a new link.
What if someone does not confirm?
Do not add them to the list. You may send one reminder after a short delay, but do not keep mailing people who have not confirmed.
Should I pre-tick the subscribe box?
No. Pre-ticked boxes weaken consent and are not valid under some laws. Leave the box empty and use clear wording.